CVE-2026-57498

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/coollabsio/coolify/security/advisories/GHSA-725v-f5gh-22q9
https://github.com/coollabsio/coolify/security/advisories/GHSA-725v-f5gh-22q9

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versión 4.0.0-beta.474, los controladores de la API de Coolify validaban consistentemente la propiedad del servidor con Server::whereTeamId($teamId) antes de cualquier operación. Sin embargo, múltiples componentes de la interfaz de usuario web de Livewire aceptan server_id y destination_uuid de los parámetros de consulta de la URL sin ninguna validación de propiedad de equipo, lo que permite el despliegue de recursos entre equipos. Esta vulnerabilidad se corrigió en la versión 4.0.0-beta.474.

Information

Published : 2026-06-29 20:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-57498

Mitre link : CVE-2026-57498

CVE.ORG link : CVE-2026-57498

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-57498", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57498", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-30T14:24:55.710391Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.474"}]}]}], "published": "2026-06-29T20:17:40.013", "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-725v-f5gh-22q9", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-725v-f5gh-22q9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.474, los controladores de la API de Coolify validaban consistentemente la propiedad del servidor con Server::whereTeamId($teamId) antes de cualquier operaci\u00f3n. Sin embargo, m\u00faltiples componentes de la interfaz de usuario web de Livewire aceptan server_id y destination_uuid de los par\u00e1metros de consulta de la URL sin ninguna validaci\u00f3n de propiedad de equipo, lo que permite el despliegue de recursos entre equipos. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 4.0.0-beta.474."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "security-advisories@github.com"}