CVE-2026-34047

Published: Jul 7, 2026Modified: Jul 7, 2026Deferred

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (5)

https://github.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf1621cd5

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/pull/9169

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c

Source: security-advisories@github.com

https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.