What is the CVSS score of EUVD-2026-41991?

EUVD-2026-41991 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Coolify are affected by EUVD-2026-41991?

Coolify self-hosted PaaS deployments prior to version 4.0.0-beta.466 allow authenticated users to access application logs across customer teams, circumventing multi-tenant isolation.. A patch is available.

How to fix or mitigate EUVD-2026-41991?

Within 24 hours: Identify all Coolify instances in production and document current versions. Within 7 days: Upgrade to 4.0.0-beta.466 or later; if unavailable, implement network segmentation restricting log endpoint access to authorized teams only. Within 30 days: Audit historical log access patterns for unauthorized cross-team queries; review and strengthen team ownership enforcement in RBAC policies.

Coolify EUVD-2026-41991

| CVE-2026-34044 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 GitHub_M

Authentication Bypass Coolify Coollabsio

7.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Any authenticated user (PR:L) can trigger the network log endpoint with low complexity; cross-team access crosses a trust boundary (S:C) exposing logs (C:H) with no write or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:05 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID. This issue is fixed in version 4.0.0-beta.466.

AnalysisAI

Cross-tenant log disclosure in Coolify (self-hosted PaaS) before 4.0.0-beta.466 lets any authenticated user read application logs belonging to other teams by supplying a victim resource's UUID. The Logs::mount() component resolves resources by UUID alone without verifying the caller's team ownership, breaking the multi-tenant isolation boundary. Rated CVSS 7.7 (CWE-639, IDOR); no public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix is a one-line-class authorization check that is trivially reversible from the public commit.

Technical ContextAI

Coolify is an open-source, self-hostable platform-as-a-service (a Heroku/Netlify alternative) for deploying and managing servers, applications, and databases, using a team-based multi-tenancy model to separate customers/projects. The vulnerable Logs::mount() method (a Livewire/PHP component in the coollabsio/coolify codebase) performs a direct object lookup keyed on a user-supplied resource UUID but omits a scope filter binding that lookup to the authenticated user's current team. This is the classic CWE-639 (Authorization Bypass Through User-Controlled Key / Insecure Direct Object Reference) root cause: the identifier is authenticatable but the object it points to is never authorized against the caller. The affected product per CPE is cpe:2.3:a:coollabsio:coolify (all versions prior to the fix).

RemediationAI

Vendor-released patch: upgrade to Coolify 4.0.0-beta.466 or later, which adds team scoping to the Logs::mount() resource lookup (release: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466; advisory: https://github.com/coollabsio/coolify/security/advisories/GHSA-565g-9j4m-wqmr). Because this is a beta channel, validate the upgrade in staging first given other beta changes may ship alongside the fix. Until patched, reduce exposure by limiting who holds accounts on the instance: restrict registration, remove or disable unneeded user accounts, and where feasible operate single-team-per-instance so no cross-tenant data exists to leak. As a network compensating control, place the Coolify dashboard behind a VPN or trusted-IP allowlist so only vetted operators can reach the authenticated UI - trade-off is reduced convenience for distributed teams. Note that because logs may contain secrets, tokens, or credentials, also consider rotating sensitive material that could have appeared in application logs on shared instances.