CVE-2026-34044: Coolify Cross-Team Log Access via Authorization Bypass

Technical summary

The Logs::mount() component in Coolify performs UUID-based resource lookups without enforcing team-level authorization controls. When a logged-in user requests logs for a resource, the system validates the UUID but fails to verify that the requesting user's team owns the target application. This allows cross-team log access via direct UUID enumeration or supply. The vulnerability is classified as an authorization bypass (CWE-639) with a CVSS 3.1 score of 7.7 (HIGH), reflecting the broad scope of access and high confidentiality impact.

Business impact

Organizations deploying Coolify in multi-tenant or multi-team environments face significant data exposure risk. Application logs often contain sensitive information including credentials, API keys, database queries, and business logic details. An attacker with valid credentials to one team can harvest logs from competing teams or other internal business units, leading to credential compromise, competitive intelligence theft, and compliance violations. The broad scope of the vulnerability (CVSS:S:C) means a standard user in one team can access resources outside their authorization boundary.

Affected systems

Coolify versions prior to 4.0.0-beta.466 are affected. The vulnerability requires authentication, so only deployed instances with active user accounts are at risk. Organizations running self-hosted Coolify deployments in multi-team configurations are most exposed. Single-team or isolated deployments have lower practical risk, though the authorization flaw remains present.

Exploitability

Exploitation requires valid authentication credentials but no special interaction from the target user. An attacker simply needs to know or enumerate the UUID of an application belonging to another team, then request its logs via the vulnerable endpoint. UUID discovery can occur through reconnaissance, error messages, or systematic enumeration. The low attack complexity and lack of user interaction (CVSS:AC:L/UI:N) make this practical to exploit at scale once credentials are obtained.

Remediation

Upgrade Coolify to version 4.0.0-beta.466 or later. The patch adds team-level scoping to the Logs::mount() component, ensuring UUID lookups are restricted to the requesting user's team. Prior to upgrading, limit Coolify user account creation to trusted team members and implement network-level access controls to restrict who can reach the Coolify management interface.

Patch guidance

Apply version 4.0.0-beta.466 as your immediate remediation target. Verify the upgrade path in your deployment environment (Docker, package manager, or source installation). Test the upgrade in a non-production environment first to confirm application functionality and team isolation behavior. Document the team membership and access patterns in your Coolify instance before upgrading to establish a baseline for post-patch validation.

Detection guidance

Monitor Coolify access logs for unusual patterns: authentication events followed by rapid log requests for multiple distinct resource UUIDs, especially UUIDs not previously accessed by that user. Audit user-to-team assignments and cross-reference against historical log access patterns. Check application logs for requests to the Logs::mount() endpoint with UUID parameters that don't correspond to the requesting user's owned resources. If available, enable verbose logging on the Logs component to track authorization decisions.

Why prioritize this

This vulnerability merits rapid patching despite the authentication requirement because: (1) it enables broad lateral movement across teams within the same Coolify instance, (2) logs are high-value targets for attackers seeking credentials or operational intelligence, (3) exploitation is trivial once credentials exist, and (4) many self-hosted tools experience credential compromise through phishing or weak password practices, making the 'authenticated user' precondition more realistic than it initially appears.

Risk score, explained

The CVSS 7.7 (HIGH) score reflects the combination of network accessibility, low attack complexity, high confidentiality impact, and broad scope. The score appropriately elevates the risk beyond a standard CVSS 5-6 because the vulnerability allows an authenticated user to escape their authorization boundary and access resources across team boundaries—a classic privilege escalation indicator. The absence of integrity and availability impact (no data modification or denial of service) prevents a critical rating.

Frequently asked questions