What is the CVSS score of CVE-2026-34050?

CVE-2026-34050 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-34050?

Yes, a patch is available for CVE-2026-34050. Update the affected software to the latest version immediately.

Coolify CVE-2026-34050

EUVD-2026-41950 MEDIUM

Missing Authorization (CWE-862)

2026-07-06 GitHub_M

Authentication Bypass Coolify Coollabsio

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible Livewire component requires only a low-privilege account; integrity impact is high as update policy can be altered; no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:49 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, allowing non-admin users to access the Updates settings page and potentially modify auto-update settings or trigger update checks. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

Missing authorization in Coolify's Settings/Updates Livewire component allows any authenticated non-admin user to access the Updates settings page and modify auto-update behavior or trigger update checks. Affected versions span all releases prior to 4.0.0-beta.471 of the self-hosted server management platform. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible nature and low authentication bar (any valid account) make this a meaningful integrity risk in multi-tenant or shared Coolify deployments.

Technical ContextAI

Coolify is a PHP/Laravel application built on Livewire, a framework that renders reactive server-side UI components. In Livewire, the mount() method initializes a component when it is first rendered - it is the correct location to enforce access control before any component state is exposed to the client. CWE-862 (Missing Authorization) applies here: the Settings/Updates component omits a call to isInstanceAdmin during mount, so the framework renders the component and exposes its actions to any authenticated session regardless of role. The affected CPE is cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:* covering all versions before 4.0.0-beta.471. The flaw is confined to the update-management surface - it does not expose a general authorization bypass across the application.

RemediationAI

Upgrade to Coolify 4.0.0-beta.471 or later, which introduces the missing isInstanceAdmin check in the Settings/Updates Livewire component's mount method. The upstream fix is confirmed by commit 0fed553207383f384b93cba24d28122065fa67d5 and pull request https://github.com/coollabsio/coolify/pull/9206. If an immediate upgrade is not feasible, a practical compensating control is to audit and remove any non-admin user accounts from the Coolify instance, since the vulnerability requires a valid low-privilege session. Restricting network access to the Coolify dashboard (e.g., behind a VPN or IP allowlist) reduces exposure to the network attack vector but does not eliminate the flaw for users already inside that boundary. Full remediation requires the vendor patch.