Coolify EUVD-2026-41996

Requires an authenticated Coolify account (CVSS PR:L) and a multi-tenant deployment where more than one team exists - the attacker must be able to reference a destination resource ID owned by a different team, which is the concrete prerequisite since single-team instances have no cross-tenant target. The specific trigger is the cloneTo() Livewire action in ResourceOperations.php with an attacker-supplied destination ID; the source resource is properly authorized, so the abuse is entirely in the unscoped destination lookup. Limiting factors: a valid login is mandatory (not unauthenticated), and practical impact only materializes when the instance hosts multiple independent teams whose resources the attacker does not already own.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L yields 9.9 driven largely by the scope change (S:C) reflecting one tenant reaching another tenant's data. Real-world risk is meaningfully constrained by PR:L: exploitation requires a valid authenticated account on the Coolify instance, so exposure is highest on multi-team/shared or SaaS-style deployments and low on single-operator self-hosted installs where the attacker would already own all resources. No EPSS score, KEV listing, or POC was provided, so there is no signal of active exploitation - no public exploit identified at time of analysis. The primary uncertainty is deployment model: the CVSS assumes a populated multi-tenant environment; a single-team instance has little practical impact despite the high base score, so defenders should weight this by whether their instance hosts multiple independent teams.

An attacker signs up for or already holds a low-privileged account on a shared Coolify instance that hosts multiple teams. Using the clone feature, they invoke the cloneTo() Livewire action with a destination identifier belonging to another team, and because the destination is resolved without a team scope, they clone into and read resources owned by that victim tenant. No user interaction or elevated privileges are needed beyond the authenticated session; no public POC was provided.