Coolify EUVD-2026-40236

Exploitation requires a valid authenticated Coolify account (CVSS PR:L) and a deployment where more than one team exists on the same instance - i.e. a multi-tenant/shared setup; on a single-team self-hosted install there are no other teams' resources to reach. The attacker must know or enumerate the target's server/project IDs, which are supplied directly to the lookup. No user interaction, elevated privileges, or special non-default feature toggle is needed - the missing team-scoping affects standard server and project lookups in all versions before 4.0.0-beta.471. The main limiting factor is that the attacker must first obtain an account and that the instance must host other teams.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, score 7.7) describes a network-exploitable, low-complexity attack that needs only low-privilege authentication, no user interaction, with a changed scope and high confidentiality impact but no integrity or availability impact - consistent with a read-oriented cross-tenant IDOR. No EPSS score was supplied, so statistical exploitation probability cannot be cited. The CVE is not listed in CISA KEV and no proof-of-concept is referenced, so this is not confirmed as actively exploited. Real-world priority is moderate-to-high specifically for multi-tenant Coolify instances (e.g. shared/hosted deployments where untrusted users hold accounts); for single-team self-hosted installs the practical exposure is far lower because there are no other teams to pivot into. Note a discrepancy worth verifying: the vector sets I:N/A:N, but 'access to servers and projects' in a deployment tool could in practice enable management actions (integrity/availability) - the description says only 'access', so impact beyond confidentiality is unconfirmed and should be validated against the advisory.

An attacker registers or already holds a low-privilege account on a shared Coolify instance, then iterates or guesses server/project IDs and requests those resources directly via the API or UI. Because lookups are not team-scoped, the server returns details of another team's servers and projects, exposing infrastructure and deployment information the attacker should never see. No proof-of-concept is publicly referenced, and the network vector with low attack complexity makes the request itself trivial once authenticated.