What is the CVSS score of CVE-2026-34037?

CVE-2026-34037 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Coolify are affected by CVE-2026-34037?

Coolify instances before version 4.0.0-beta.464 are vulnerable to cross-team data access where an authenticated user of any team can read, clone, and manipulate resources belonging to other teams,…. A patch is available.

How to fix or mitigate CVE-2026-34037?

24 hours: Inventory all Coolify deployments and identify versions; review access logs for anomalous cross-team resource cloning activity between teams. 7 days: Restrict Coolify platform access to essential users only; establish alert rules for resource clone operations; monitor vendor advisories for patch release. 30 days: Upgrade Coolify to version 4.0.0-beta.464 or later once available; conduct comprehensive access audit to identify resources accessed across unauthorized team boundaries.

Coolify CVE-2026-34037

EUVD-2026-41996 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 GitHub_M

Authentication Bypass PHP Coolify

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.9 CRITICAL

Authenticated web action (PR:L, AV:N, AC:L) with no user interaction; tenant-boundary bypass justifies S:C, with high confidentiality/integrity over cross-team resources and low availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:07 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

Articles & Coverage 1

News Critical Cross-Tenant Access Vulnerability in Coolify Self-Hosted PaaS - CVE-2026-34037 Jul 07, 2026

AnalysisAI

Cross-tenant resource access in Coolify (self-hosted PaaS) before 4.0.0-beta.464 lets an authenticated user of one team clone resources into, and access resources owned by, other teams. The cloneTo() Livewire action in ResourceOperations.php checks authorization on the source resource but resolves destination resources with unscoped Eloquent lookups, breaking multi-tenant isolation. Rated CVSS 9.9 with scope change; no public exploit identified at time of analysis, but a fixing commit and vendor advisory are published.

Technical ContextAI

Coolify is an open-source, self-hostable platform for deploying and managing servers, applications, and databases, built on the Laravel/Livewire (PHP) stack. The flaw is a classic CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the cloneTo() action correctly scopes the source object to the caller's team but then loads the destination via a direct, unscoped Eloquent model lookup (e.g. Model::find($id)) driven by a user-supplied identifier, without re-checking team ownership. In a multi-tenant deployment where teams are the isolation boundary, any authenticated user can therefore reference IDs belonging to other tenants. The affected component is coollabsio/coolify per CPE cpe:2.3:a:coollabsio:coolify.

RemediationAI

Vendor-released patch: upgrade to Coolify 4.0.0-beta.464 or later, which adds team scoping to destination resource resolution in the cloneTo() action (fixing commit 1759a1631cd63271ebf6caa250c6d93440eaa333; advisory GHSA-ggrr-wrvr-x83v at https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v; release https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464). If you cannot upgrade immediately, reduce the attack surface by limiting accounts to trusted operators and, where feasible, running one team per Coolify instance so cross-tenant lookups have nothing to reach - the trade-off is losing multi-team consolidation. Also restrict network access to the Coolify dashboard to trusted networks/VPN to shrink who can reach the authenticated Livewire endpoints, accepting the operational cost of gated access. These are stopgaps only; the clone/destination logic itself is not disableable per resource, so patching is the reliable fix.