CVE-2026-27881: Coolify Broken Object-Level Authorization in Deployment API

Technical summary

The vulnerability resides in the GET /api/v1/deployments/{uuid} endpoint within DeployController.php. The endpoint retrieves deployment records based on a provided UUID parameter but fails to enforce team-level access control. Specifically, the code does not validate that the requesting user's team owns or has authorization to access the queried deployment before returning the response. This is a classic broken object-level authorization (CWE-639) flaw. An attacker can enumerate or discover deployment UUIDs through various means and request deployment details without restriction, leading to information disclosure across team boundaries.

Business impact

For organizations self-hosting Coolify in multi-tenant or team-based environments, this vulnerability creates a data confidentiality breach risk. Sensitive deployment configurations, database credentials (if included in the response), environment variables, and application metadata could be exposed to unauthorized API consumers within the same Coolify instance. In regulated industries, such cross-team data exposure may violate compliance requirements. The impact is amplified in shared hosting scenarios where multiple customer organizations run on a single Coolify deployment.

Affected systems

All Coolify installations prior to version 4.0.0-beta.464 are affected. Any organization running an older 4.0.0-beta release (up to and including beta.463) or earlier stable versions should be considered vulnerable if the API is accessible to authenticated users. Self-hosted instances are at direct risk; the open-source nature of Coolify means the scope depends on adoption rates in target environments.

Exploitability

Exploitation requires valid API credentials, placing this in the CVSS 'Low privilege' category. The attack is straightforward: an authenticated user simply crafts API requests with deployment UUIDs from other teams. No complex interaction, special conditions, or user interaction is necessary. The primary barrier to exploitation is obtaining legitimate API access; once an attacker has credentials (via phishing, lateral movement, or as a low-privileged team member), enumeration and data extraction can be rapid and automated. The CVSS score of 5.0 (Medium) reflects this balance.

Remediation

Upgrade Coolify to version 4.0.0-beta.464 or later. Verify the patch has been applied and the deployment service has been restarted. After patching, audit API access logs to detect any unauthorized deployment queries from the period prior to update. Establish API rate limiting and monitoring to detect future enumeration attempts. Consider implementing API key rotation policies to minimize the window of exposure if credentials were compromised.

Patch guidance

Deploy version 4.0.0-beta.464 or any subsequent release. Refer to the official Coolify GitHub repository and release notes to confirm patch availability and deployment steps for your environment. Given the beta status of current releases, review the changelog to understand any breaking changes or migration steps. Test the update in a non-production environment first, especially if you are running a stable release prior to the 4.0.0-beta line.

Detection guidance

Monitor API logs for repeated GET requests to /api/v1/deployments/{uuid} endpoints with varying UUIDs, particularly from single API clients or users querying deployments outside their team. Implement Web Application Firewall (WAF) rules to flag suspicious enumeration patterns. If you have retained request logs from before patching, search for requests where the deployment UUID does not match the authenticating user's team ownership. Consider adding rate limiting to the deployment endpoint to slow brute-force enumeration.

Why prioritize this

Although assigned a Medium CVSS score, this vulnerability should be prioritized for immediate patching in any multi-tenant Coolify deployment. Information disclosure of deployment configurations is a significant risk in shared environments, and the fix is straightforward. Unpatched instances expose customer data across organizational boundaries, creating legal and operational risk. Prioritize instances with multiple teams or external API users.

Risk score, explained

The CVSS 3.1 score of 5.0 reflects a network-accessible vulnerability requiring only low-privilege authentication (PR:L), with no user interaction, affecting the confidentiality of deployment information (C:L) while not impacting integrity or availability. The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component. While not critical, the exposure of multi-tenant deployment metadata and potential credential leakage justifies Medium severity and swift remediation.

Frequently asked questions