CVEvulnerability

CVE-2025-22611

9.9 CRITICAL Published 2025-01-24 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-01-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-862

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able to kick every other member out of the team, including admins and owners. This allows the attacker to access the `Terminal` feature and execute remote commands. Version 4.0.0-beta.361 fixes the issue.

Affected configurations

• coollabs coolify (< 4.0.0) • coollabs coolify 4.0.0

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References