CVE-2026-32718: Coolify API Authorization Bypass – Read Tokens Can Modify Infrastructure

Technical summary

The vulnerability stems from improper authorization enforcement on mutating API endpoints in Coolify. Endpoints designed to modify state (such as cloud token validation and server validation) are guarded by read ability checks rather than write or admin permission checks. This creates an authorization bypass where API tokens with read-only scope can invoke state-changing operations that should be restricted to higher privilege levels. The root cause is CWE-863 (Incorrect Authorization), indicating a logic error in the access control implementation. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects network accessibility, low complexity, requirement for valid credentials, and high integrity impact without confidentiality or availability loss.

Business impact

This authorization bypass allows legitimate API consumers with limited permissions to perform unintended infrastructure modifications. An insider with read-only API access—or an external party who compromises such a token—can validate (and potentially establish) cloud tokens and server configurations without proper authorization. This creates risk of unauthorized cloud environment binding, server reconfiguration, or persistence mechanisms established through token validation workflows. In multi-tenant or delegated access scenarios, the impact extends to cross-boundary privilege escalation where one tenant's read access enables modification of shared infrastructure state.

Affected systems

Coolify versions prior to 4.0.0-beta.466 are affected. The vulnerability is present in the current stable and beta release lines until the specified patch version. Self-hosted Coolify deployments running older versions face direct exposure. Organizations using Coolify to manage cloud infrastructure, on-premises servers, or hybrid environments are in scope if they have issued read-scoped API tokens to any consumer (service accounts, integrations, delegated users).

Exploitability

The vulnerability requires valid API credentials with read scope—a low bar for many organizations, as read access is often granted broadly for monitoring and auditing purposes. No user interaction is required, and exploitation is straightforward: an attacker simply invokes the affected mutation endpoints using read-scoped token credentials. No special network position, zero-days, or complex techniques are needed. However, active exploitation requires either pre-compromise of a read token or insider access, limiting opportunistic attack surface. The lack of CISA KEV listing suggests minimal public exploitation to date, though the authorization flaw is trivial to discover and weaponize once disclosed.

Remediation

Upgrade Coolify to version 4.0.0-beta.466 or later. The fix corrects authorization guards on mutating endpoints to enforce write or higher permission checks instead of read checks. Organizations running production Coolify instances should prioritize this patch given the ease of exploitation and the sensitive nature of infrastructure management tokens. If immediate patching is not feasible, restrict API token scope to the absolute minimum required and implement network-level controls to limit which services can invoke Coolify API endpoints.

Patch guidance

Coolify maintainers released version 4.0.0-beta.466 as the fix. Users should consult the official Coolify release notes and advisory (linked in vendor communications) to confirm patch availability and any migration notes for their deployment model. Beta versions may entail different stability considerations than stable releases; verify testing and rollback procedures before deploying to production infrastructure. If your organization is on a stable release cadence, confirm the patch timeline for integration into the next stable version.

Detection guidance

Monitor API access logs for invocations of mutating endpoints (cloud token validation, server validation, or similar state-changing operations) originating from API tokens scoped with read-only permissions. Look for patterns where read-scoped tokens trigger configuration changes, server registrations, or cloud credential bindings. Inspect API audit logs for permission mismatches: cases where the operation scope required exceeds the token's declared scope. Implement alerting on any read-scoped token usage for mutation operations. Additionally, review active API tokens in your Coolify deployment to identify unnecessarily broad read scopes and enforce principle of least privilege.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the vulnerability warrants relatively high priority for Coolify operators because: (1) it enables unauthorized infrastructure modification, which has outsized business impact regardless of confidentiality/availability metrics; (2) exploitation is trivial and requires only compromised or malicious read-scoped tokens, which are common in delegated access scenarios; (3) Coolify manages critical infrastructure (servers, databases, cloud environments), so state corruption can cascade; (4) read tokens are often issued liberally for monitoring, increasing the attack surface. Organizations using Coolify to manage production infrastructure should treat this as a timely patch, even if not critical.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the core impact: high integrity risk (unauthorized state modification) with no confidentiality or availability loss, balanced against the requirement for valid API credentials (PR:L). The score appropriately captures a privilege-escalation scenario where low-privilege users exceed their authorization, but does not fully weight the business sensitivity of infrastructure management contexts. In environments where read-scoped API tokens are shared across multiple services or delegated widely, effective risk exceeds the base score; conversely, in restricted access models, risk may be lower. Use the CVSS as a baseline and adjust prioritization based on token distribution and delegation practices in your deployment.

Frequently asked questions