Coolify EUVD-2026-41950

Exploitation requires a valid authenticated session with any non-admin role on the target Coolify instance - specifically, an account that would not normally pass the isInstanceAdmin check. The vulnerability is in the Settings/Updates Livewire component and is only reachable when an instance has at least one non-admin user account provisioned. Exploitation is limited to users who can authenticate to the Coolify web interface; the CVSS PR:L confirms low-privilege authentication is required. Single-admin instances with no non-admin accounts are not exposed. There is no unauthenticated path and no special network-level precondition beyond reachability to the Coolify dashboard.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) scores 6.5 and accurately reflects the threat model: network-reachable, low complexity, but gated behind a valid (low-privilege) user account, with no confidentiality or availability impact. The integrity impact is rated High because a non-admin user can alter instance-level update configuration - potentially suppressing critical security updates or forcing an unscheduled update on a production system. EPSS data is not present in the provided intelligence; given the absence of KEV listing and no POC code, opportunistic mass exploitation is unlikely. The primary real-world risk is insider threat or a compromised low-privilege account in a shared Coolify deployment. This is a genuine priority for multi-user instances but not an emergency for single-admin self-hosters where no non-admin accounts exist.

An attacker with a valid non-admin account on a shared Coolify instance (e.g., a developer given access to deploy applications) directly navigates to the Settings/Updates page. Because no isInstanceAdmin check is enforced in the Livewire component mount, the page renders normally and the attacker can disable automatic security updates or trigger an immediate update cycle, potentially destabilizing a production environment. No exploit tooling is required beyond a standard web browser session.