EUVD-2026-41951Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed Coolify API
-
DeliverySend unauthenticated POST to /api/feedback
-
ExploitSupply arbitrary payload content
-
ExecutionCoolify forwards payload to configured Discord webhook
-
ImpactInject spam or false content into operator Discord channel
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for network-adjacent exploitation: CVSS AV:N/AC:L/PR:N/UI:N confirms the endpoint is network-accessible and requires no authentication, no special configuration, and no user interaction. The specific condition enabling the attack is that the Coolify instance has a Discord webhook configured for the feedback feature and that the /api/feedback API endpoint is reachable from the attacker's network. Exploitation is limited to Discord webhook abuse - an attacker cannot read data (C:N), execute code, or directly interact with the managed servers or databases. External exploitation is prevented if the Coolify API port is restricted to internal networks or VPN, which represents the primary limiting factor for real-world risk. |
| Impact | CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) accurately characterizes this as a medium-severity, low-complexity, fully unauthenticated network attack. Integrity impact is Low (content injection into Discord channel) and Availability impact is Low (webhook flooding can exhaust Discord API rate limits, dropping legitimate notifications). Critically, there is no Confidentiality impact - this is not a data exfiltration issue. No KEV listing and no confirmed POC code lower the urgency relative to raw CVSS; EPSS data was not provided in the input. The realistic risk to most operators is operational disruption to Discord-based alerting pipelines rather than system compromise. Coolify instances not exposed to the public internet (deployed behind VPN or internal firewall) face no external exploitation risk. The vulnerability is a genuine priority for internet-facing Coolify deployments relying on Discord webhooks for operational alerting. |
| Exploit ScenarioDerived | An attacker enumerates an internet-exposed Coolify instance and identifies the /api/feedback endpoint. Using a scripted loop of unauthenticated HTTP POST requests with arbitrary body content, the attacker floods the operator's Discord channel with thousands of fabricated alert messages, obscuring legitimate operational notifications or injecting misleading status content. No exploit code, credentials, or special tooling are required beyond a basic HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Unauthenticated access to Coolify's POST /api/feedback endpoint allows any remote attacker to forward arbitrary content directly to the operator's configured Discord webhook, enabling spam flooding, content injection, and webhook rate-limit abuse. All self-hosted Coolify instances prior to 4.0.0-beta.474 are affected, with CVSS AV:N/AC:L/PR:N/UI:N confirming zero-barrier network exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploit conditions (plain unauthenticated HTTP POST) make automated abuse straightforward.
RemediationAI
Upgrade to Coolify version 4.0.0-beta.474 or later, which introduces authentication, rate limiting, and input validation on the POST /api/feedback endpoint per commit 371e883c75a87d82c398bf89ee8ad6387348520d and pull request #9653 (https://github.com/coollabsio/coolify/pull/9653). As a compensating control for operators unable to patch immediately, block external access to the /api/feedback route at the reverse proxy or firewall layer - for example, deny requests to that path from non-internal IP ranges. This trade-off means legitimate unauthenticated feedback submissions (if any are expected) would also be blocked, but it eliminates the abuse surface with no impact to core Coolify functionality. The security advisory at https://github.com/coollabsio/coolify/security/advisories/GHSA-v64c-v633-58xp should be consulted for vendor-confirmed remediation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Coolify is a self-hosted PaaS management tool by coollabsio (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*) that allows operators to manage servers, applications, and databases. The root cause is CWE-306 (Missing Authentication for Critical Function): the POST /api/feedback API endpoint performs no authentication check before passing caller-supplied request body content to a Discord webhook integration. Discord webhooks accept HTTP POST requests from any caller and relay the payload as a message into a Discord channel - making this endpoint effectively a proxy that any unauthenticated internet actor can weaponize. The absence of rate limiting compounds the issue by enabling automated high-volume abuse, and the lack of input validation means the injected content is forwarded verbatim, enabling content injection into the operator's operational notification channel.
Know when Coolify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible unauthenticated endpoint with no preconditions; impact is confined to Discord webhook integrity and availability, not system confidentiality or code execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling spam, content injection, and webhook abuse. This issue is fixed in version 4.0.0-beta.474.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Cross-team authorization bypass in Coolify (open-source self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated,
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deplo
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application d
Command injection in Coolify up to and including v4.0.0-beta.434 lets any authenticated low-privileged 'member' execute
Remote code execution on the host OS is possible through Coolify's application deployment workflow prior to version 4.0.
Authenticated command injection in Coolify's PostgreSQL initialization-script filename handling allows users with applic
Coolify versions prior to 4.0.0-beta.451 pass user-supplied database names unsanitized into shell commands executed via
Authenticated Coolify users who hold application or service management permissions can execute arbitrary commands as roo
Authenticated command injection in Coolify before 4.0.0-beta.451 lets users with application or service management permi
Stored cross-site scripting in Coolify versions up to and including v4.0.0-beta.420.6 lets an authenticated low-privileg
Authenticated OS command injection in Coolify before 4.0.0-beta.471 lets any user holding destination management permiss
Authenticated remote code execution in Coolify (self-hosted PaaS) before 4.0.0-beta.470 lets a low-privileged authentica
Exploit-DB