EUVD-2026-41959Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
PR:L for required authentication; S:C for cross-team boundary violation; C:H because exposed SSH outputs routinely contain credentials enabling downstream infrastructure compromise.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's #[Locked] attribute. It loads activities via Activity::find($this->activityId) with no authorization or team scoping. Activity IDs are auto-incrementing integers. Any authenticated user can enumerate activity records across all teams and read the full command output from remote SSH processes, which may include secrets, configuration files, and infrastructure details. This issue is fixed in version 4.0.0-beta.471.
AnalysisAI
Insecure Direct Object Reference (IDOR) in Coolify's ActivityMonitor Livewire component allows any authenticated user to enumerate and read activity records belonging to other teams, including full SSH process command outputs that may contain secrets, credentials, and infrastructure configuration details. Affected are all Coolify self-hosted deployments prior to version 4.0.0-beta.471. No special privileges beyond a valid user account are required, and auto-incrementing integer activity IDs make enumeration trivial. No public exploit code has been identified at time of analysis and this CVE is not in CISA KEV, but the low attack complexity and sensitive data exposure make this a meaningful risk for multi-tenant Coolify deployments.
Technical ContextAI
Coolify is built on Laravel with Livewire for reactive frontend components. Livewire exposes component properties to the client and, without the #[Locked] attribute, allows client-controlled property manipulation. The ActivityMonitor Livewire component's public $activityId property is tampered client-side, and the backend resolves it via Activity::find($this->activityId) with no team-scoping or authorization gate. Because activity IDs are auto-incrementing integers (a sequential primary key anti-pattern for sensitive resources), an attacker can iterate IDs 1, 2, 3... to retrieve all recorded activities across every team on the instance. CWE-639 (Authorization Through User-Controlled Key) is the root cause: authorization decisions are delegated to a user-supplied identifier with no ownership check. The CPE cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:* confirms all versions prior to the fix are affected.
RemediationAI
Upgrade to Coolify version 4.0.0-beta.471 or later, which adds the Livewire #[Locked] attribute to $activityId and enforces team-scoped authorization on activity lookups, as detailed in the security advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-962v-gxmw-56hc and the pull request at https://github.com/coollabsio/coolify/pull/9189. For deployments that cannot immediately upgrade, a compensating control is to restrict Coolify access to a single trusted user or team per instance, eliminating cross-team exposure. Alternatively, network-level access controls (firewall, VPN, allowlisting) should restrict who can reach the Coolify web interface, reducing the pool of users who could exploit this. Auditing existing activity logs for unexpected access patterns across teams is advisable post-remediation to assess whether exploitation occurred. Note that the workaround of restricting to single-team use carries the operational trade-off of breaking multi-tenant workflows.
Coolify, a self-hosted server management platform, allows authenticated users to inject OS commands through the Git Repo
A command injection vulnerability in Coolify's Database Backup functionality allows authenticated users with application
Coolify through v4.0.0-beta.434 exposes the root user's SSH private key to low-privileged team members. Any user with ba
Cross-team authorization bypass in Coolify (open-source self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated,
Coolify before 4.0.0-beta.445 allows command injection through docker-compose.yaml parameters. If a victim creates an ap
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deplo
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application d
Authenticated OS command injection in Coolify before 4.0.0-beta.471 lets any user holding destination management permiss
Authenticated remote code execution in Coolify (self-hosted PaaS) before 4.0.0-beta.470 lets a low-privileged authentica
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. [CVSS 8.8 HIGH]
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0
An authenticated command injection vulnerability in Coolify's PostgreSQL initialization script handling allows attackers
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today