CVE-2026-27956: Coolify Team Scoping Bypass in API Domains Endpoint

Technical summary

The vulnerability exists in the GET /api/v1/servers/{server_uuid}/domains endpoint. When the optional uuid query parameter is supplied, the API fails to enforce team-level authorization checks, allowing any authenticated user to enumerate FQDNs associated with applications outside their team context. The root cause is improper authorization logic that bypasses team scoping when the uuid parameter is present. CWE-639 (Authorization Bypass Through User-Controlled Key) applies. The flaw was patched in version 4.0.0-beta.464.

Business impact

This information disclosure creates operational security risks for multi-tenant Coolify deployments. Teams operating isolated projects lose the expectation that their application domains remain confidential from other authenticated users. An attacker with valid API credentials can map the infrastructure topology and domain naming patterns of competing teams or other organizational units, potentially enabling reconnaissance for further attacks, competitive intelligence gathering, or targeted social engineering. Organizations relying on domain name obscurity as a security boundary are directly affected.

Affected systems

Coolify versions prior to 4.0.0-beta.464 are affected. The vulnerability only impacts API users with valid authentication credentials; it requires access to a Coolify instance and a valid API token or session. The flaw is introduced in the endpoint's handling of the optional uuid parameter, making it a configuration or logic-level issue rather than a widespread architectural problem affecting all installations.

Exploitability

Exploitation requires authenticated access and knowledge of the affected endpoint structure, making it accessible to insider threats, former employees with retained credentials, or external attackers who have compromised a valid API token. The attack surface is limited to authenticated API consumers; no pre-authentication or complex exploitation steps are needed. The low complexity and reliance only on valid credentials result in the CVSS score of 4.3 (Medium severity), reflecting that impact is limited to confidentiality and does not affect integrity or availability.

Remediation

Organizations running Coolify must upgrade to version 4.0.0-beta.464 or later. This patch corrects the authorization logic to properly enforce team scoping even when the optional uuid parameter is supplied. Upgrading should be prioritized for instances serving multiple distinct teams or organizations where cross-team visibility is a security concern. Verify the installed version and apply updates through the standard Coolify release channels.

Patch guidance

Update Coolify to version 4.0.0-beta.464 or any subsequent release. Consult the official Coolify repository and release notes for deployment instructions specific to your installation method (Docker, standalone, etc.). Test the upgrade in a staging environment first, particularly if you rely on Coolify API integrations or automation. Confirm that the patch is applied by checking the version reported by your Coolify instance and verifying that the authorization behavior of the affected endpoint has been corrected.

Detection guidance

Review access logs for the /api/v1/servers/{server_uuid}/domains endpoint, particularly requests that include the uuid query parameter from users or service accounts not belonging to the owning team. Monitor API audit trails for unusual enumeration patterns or repeated requests across different server_uuid values by a single authenticated user. If your Coolify instance logs API requests, correlate calls to this endpoint with the authenticated principal and compare against expected team membership. Deploy network-level monitoring if API usage patterns can be tracked at the load balancer or API gateway.

Why prioritize this

Although the CVSS score is moderate (4.3), prioritize this patch in multi-tenant environments or where team isolation is a security requirement. Single-tenant or isolated Coolify deployments face minimal risk. Organizations with strict data segregation policies, competitive teams, or sensitive domain naming schemes should treat this as higher priority. The fix is straightforward and carries low deployment risk, making it an efficient remediation candidate.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium severity. Network-accessible endpoint (AV:N), low attack complexity (AC:L), and requirement for valid authentication (PR:L) define the attack vector. Impact is limited to confidentiality (C:L) with no integrity or availability impact (I:N, A:N). The score appropriately penalizes the information disclosure while acknowledging that the attack requires prior authentication and does not grant access to modify or disrupt services. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Frequently asked questions