CVE-2026-34037

Published: Jul 7, 2026Modified: Jul 7, 2026Deferred

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Exploitability: 3.1 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.