CVE-2026-34044

Published: Jul 7, 2026Modified: Jul 9, 2026Deferred

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.1 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID. This issue is fixed in version 4.0.0-beta.466.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

https://github.com/coollabsio/coolify/commit/6fbb5e626a82c576ae7a1a08b4e1d16aee2e82ed

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-565g-9j4m-wqmr

Source: security-advisories@github.com

Timeline

No history available yet.