What is the CVSS score of CVE-2026-41899?

CVE-2026-41899 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-41899?

Yes, a patch is available for CVE-2026-41899. Update the affected software to the latest version immediately.

Coolify CVE-2026-41899

EUVD-2026-41951 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-06 GitHub_M

Authentication Bypass Coolify Coollabsio

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated endpoint with no preconditions; impact is confined to Discord webhook integrity and availability, not system confidentiality or code execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:47 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling spam, content injection, and webhook abuse. This issue is fixed in version 4.0.0-beta.474.

AnalysisAI

Unauthenticated access to Coolify's POST /api/feedback endpoint allows any remote attacker to forward arbitrary content directly to the operator's configured Discord webhook, enabling spam flooding, content injection, and webhook rate-limit abuse. All self-hosted Coolify instances prior to 4.0.0-beta.474 are affected, with CVSS AV:N/AC:L/PR:N/UI:N confirming zero-barrier network exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploit conditions (plain unauthenticated HTTP POST) make automated abuse straightforward.

Technical ContextAI

Coolify is a self-hosted PaaS management tool by coollabsio (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*) that allows operators to manage servers, applications, and databases. The root cause is CWE-306 (Missing Authentication for Critical Function): the POST /api/feedback API endpoint performs no authentication check before passing caller-supplied request body content to a Discord webhook integration. Discord webhooks accept HTTP POST requests from any caller and relay the payload as a message into a Discord channel - making this endpoint effectively a proxy that any unauthenticated internet actor can weaponize. The absence of rate limiting compounds the issue by enabling automated high-volume abuse, and the lack of input validation means the injected content is forwarded verbatim, enabling content injection into the operator's operational notification channel.

RemediationAI

Upgrade to Coolify version 4.0.0-beta.474 or later, which introduces authentication, rate limiting, and input validation on the POST /api/feedback endpoint per commit 371e883c75a87d82c398bf89ee8ad6387348520d and pull request #9653 (https://github.com/coollabsio/coolify/pull/9653). As a compensating control for operators unable to patch immediately, block external access to the /api/feedback route at the reverse proxy or firewall layer - for example, deny requests to that path from non-internal IP ranges. This trade-off means legitimate unauthenticated feedback submissions (if any are expected) would also be blocked, but it eliminates the abuse surface with no impact to core Coolify functionality. The security advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-v64c-v633-58xp should be consulted for vendor-confirmed remediation guidance.