What is the CVSS score of CVE-2026-57498?

CVE-2026-57498 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Coolify are affected by CVE-2026-57498?

Coolify self-hosted PaaS deployments are vulnerable to an authorization bypass where an authenticated, low-privilege user in one team can deploy and manipulate infrastructure resources belonging to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-57498?

Yes, a public proof-of-concept exploit is available for CVE-2026-57498. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-57498?

24 hours: Identify all active Coolify deployments and classify by multi-tenancy usage; although no public exploit has been identified at time of analysis, immediately restrict non-administrative user access to Livewire web UI components while preserving API-only access where possible. 7 days: Upgrade to Coolify 4.0.0-beta.474 or later; validate in pre-production that low-privileged team members cannot access other teams' resources via either web UI or API. 30 days: Audit logs for unauthorized cross-team resource access; review and enforce least-privilege IAM policies; implement network segmentation between multi-tenant deployments.

Coolify CVE-2026-57498

EUVD-2026-40222 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-29 GitHub_M

Authentication Bypass Coolify

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Authenticated team member required (PR:L) over the network with no interaction; IDOR lets one tenant reach another's resources (S:C, C:H/I:H); availability not clearly impacted per advisory (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 29, 2026 - 22:02 EUVD

Analysis Generated

Jun 29, 2026 - 20:32 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.

AnalysisAI

Cross-team authorization bypass in Coolify (open-source self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated, low-privileged member of one team to deploy and manipulate resources belonging to other teams. While the REST API controllers correctly enforce ownership via Server::whereTeamId($teamId), several Livewire web UI components trust attacker-supplied server_id and destination_uuid URL query parameters with no team-ownership check (CWE-639). No public exploit identified at time of analysis, but the CVSS 9.6 rating and trivially manipulable parameters make this a high-priority fix for any multi-tenant Coolify deployment.

Technical ContextAI

Coolify is a self-hostable Heroku/Netlify-style platform-as-a-service for managing servers, applications, and databases, built on the Laravel/Livewire stack. It is multi-tenant: resources are scoped to teams, and the intended authorization model gates server access through Server::whereTeamId($teamId). The flaw is a CWE-639 (Authorization Bypass Through User-Controlled Key, i.e. IDOR) issue: the REST API controllers consistently apply the team-scoped query, but the parallel Livewire web UI components bind server_id and destination_uuid directly from URL query parameters and act on them without re-validating that the referenced server/destination belongs to the requesting user's team. Because these identifiers are user-controllable keys with no server-side ownership re-check, a member of Team A can reference Team B's server_id/destination_uuid. The single affected product per CPE is cpe:2.3:a:coollabsio:coolify (all versions prior to the fix).

RemediationAI

Upgrade to Coolify 4.0.0-beta.474, which adds team-ownership validation to the affected Livewire components; this is the primary and recommended fix (Vendor-released patch: 4.0.0-beta.474, per GHSA-725v-f5gh-22q9 at https://github.com/coollabsio/coolify/security/advisories/GHSA-725v-f5gh-22q9). If immediate upgrade is not possible, reduce exposure by treating the instance as single-tenant: avoid granting team accounts to untrusted parties and consolidate trusted operators, since exploitation requires an authenticated team member - the trade-off is loss of legitimate multi-team isolation, which this version cannot enforce. Additionally restrict network access to the Coolify web UI to trusted administrators (for example via VPN, IP allow-listing, or a reverse-proxy auth layer), accepting the trade-off of less convenient remote access, until the patched build is deployed.