Coolify EUVD-2026-41991

Exploitation requires an authenticated Coolify account (PR:L) on an instance running a version prior to 4.0.0-beta.466, plus knowledge of a target application's resource UUID owned by a different team. The specific trigger is invoking the Logs::mount() log-viewing path with a victim resource UUID, which is resolved without team scoping. Limiting factors: the attacker must possess valid credentials on the same instance (so purely private single-user or single-team deployments have no cross-tenant victim to target), and must know or discover a valid victim UUID; the flaw yields read-only access to logs only (no integrity or availability impact). No user interaction from the victim is needed.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7) is internally consistent with an IDOR: network-reachable, low complexity, requires a low-privilege authenticated account (any valid Coolify user), no user interaction, and a scope change reflecting cross-tenant boundary crossing with high confidentiality impact and no integrity/availability effect. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation - treat this as a real but non-emergency priority. The main risk amplifier is that a public fix commit exists, from which the vulnerable code path can be diffed to build an exploit; the main limiter is the PR:L requirement - the attacker must already hold a valid account on the target Coolify instance, so exposure is highest on shared/multi-team or lightly-gated self-hosted deployments and near-zero on single-team private instances. EPSS is missing rather than low, so no probability inference should be drawn.

An attacker registers or is invited to a low-privilege account on a shared Coolify instance, then obtains or guesses another team's application resource UUID (e.g., from a shared link, screenshot, or enumeration) and requests its logs view. The Logs::mount() component returns the victim team's application logs without an ownership check, exposing runtime output that may include secrets, connection strings, or user data. No public exploit is identified, but the fix commit is public and the attack requires only a normal authenticated session and a valid UUID.