CVE-2026-32718

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a
https://github.com/coollabsio/coolify/pull/8893
https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v
https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v

Configurations

No configuration.

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versión 4.0.0-beta.466, los puntos finales de validación de la API que mutan están protegidos por la capacidad de lectura, permitiendo que los tokens de API con alcance de lectura realicen operaciones que cambian el estado, como validar tokens de la nube y servidores. Este problema se soluciona en la versión 4.0.0-beta.466.

Information

Published : 2026-07-06 22:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-32718

Mitre link : CVE-2026-32718

CVE.ORG link : CVE-2026-32718

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-32718", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32718", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:01:21.284915Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.466"}]}]}], "published": "2026-07-06T22:16:47.927", "references": [{"url": "https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/pull/8893", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.466, los puntos finales de validaci\u00f3n de la API que mutan est\u00e1n protegidos por la capacidad de lectura, permitiendo que los tokens de API con alcance de lectura realicen operaciones que cambian el estado, como validar tokens de la nube y servidores. Este problema se soluciona en la versi\u00f3n 4.0.0-beta.466."}], "lastModified": "2026-10-25T20:10:00.147", "sourceIdentifier": "security-advisories@github.com"}