CVEvulnerability
CVE-2026-34047
9.9 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2026-07-07
- Last modified
- 2026-10-25
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-863
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://github.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf1621cd5 github.com
- https://github.com/coollabsio/coolify/pull/9169 github.com
- https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471 github.com
- https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c github.com
- https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c github.com