Coolify EUVD-2026-40222

The attacker must be an authenticated Coolify user holding a (low-privilege) team account on the target instance (PR:L), and the instance must be multi-tenant with more than one team so cross-team resource references exist. The concrete prerequisite is reaching one of the Livewire web UI components that accept server_id and destination_uuid from URL query parameters and supplying another team's server_id/destination_uuid values to those parameters. No victim user interaction is required (UI:N) and the attack works over the network against the standard web UI. Exploitation is limited by the need for valid credentials and by the instance actually hosting multiple teams' resources - a single-team deployment offers nothing to cross over to; the REST API path is not affected because it enforces Server::whereTeamId.

Signals are mostly consistent toward elevated risk but exploitation is bounded by authentication. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 9.6) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change (S:C) reflecting that one team's session can affect another team's protected resources. The PR:L metric confirms the attacker must be an authenticated Coolify user - this is not anonymous internet-wide exploitation, so realistic risk concentrates in multi-tenant instances where untrusted or semi-trusted users hold team accounts; a single-team/single-operator instance is largely unaffected in practice. No EPSS score, KEV listing, or POC was provided, so there is no current evidence of in-the-wild exploitation - the high score derives from impact and ease, not observed activity. One point to verify: the vector lists A:N, yet cross-team deployment/manipulation of resources could plausibly disrupt the victim team's services, so the real-world availability impact may be understated relative to the published vector.

A low-privileged but authenticated member of Team A logs into a shared Coolify instance, then opens a deployment-related Livewire page and edits the server_id and destination_uuid URL query parameters to values belonging to Team B. Because the UI component does not re-check team ownership, Coolify deploys or manipulates resources on Team B's server on the attacker's behalf, compromising another tenant's environment. No public POC is known, but the manipulation requires only a browser and valid low-privilege credentials.