CVE-2026-34050: Coolify Update Settings Authorization Bypass

Technical summary

CVE-2026-34050 stems from insufficient authorization enforcement in the Settings/Updates Livewire component. The mount method fails to validate the isInstanceAdmin flag before rendering the Updates settings interface. This permits any authenticated user with any role to access endpoint or state that should be restricted to administrators. The vulnerability affects the ability to read current auto-update configuration and potentially execute update operations. The CVSS 3.1 score of 6.5 (Medium) reflects the need for prior authentication and absence of confidentiality impact, offset by high integrity risk.

Business impact

In organizations running Coolify with multiple team members or delegated access, this flaw enables privilege escalation. A standard user could disable automatic security updates, creating a window where deployed applications remain vulnerable to known issues. Alternatively, a malicious actor with a junior account could trigger update cycles that disrupt service availability. The reputational and operational risks compound in managed hosting scenarios where Coolify supports customer workloads.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are affected. The vulnerability resides in a core component used across all Coolify installations. Self-hosted deployments and any multi-tenant or multi-user Coolify setups are most at risk, particularly those without additional network-level access controls limiting Settings/Updates page interaction.

Exploitability

Exploitation requires valid Coolify credentials, which limits the attack surface to authenticated users. No complex attack chains, special configurations, or network positioning are necessary—the flaw is directly accessible through the standard web interface. In organizations with permissive user provisioning practices, attack likelihood increases. This is not an unauthenticated attack, but it is trivial to execute for anyone with login access.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later. The patched version introduces proper isInstanceAdmin authorization checks in the Settings/Updates component's mount method, enforcing role-based access. Organizations running production Coolify deployments should schedule this update promptly, as the vulnerability affects a critical operational function.

Patch guidance

Apply Coolify 4.0.0-beta.471 or any subsequent release. Beta versions should be tested in a staging environment before production deployment to ensure compatibility with your specific configuration. Consult the Coolify release notes and vendor advisory for any additional migration or configuration guidance. If you are running a stable branch rather than beta, verify the stable version line's current status against the vendor advisory to confirm when this fix is included.

Detection guidance

Monitor access logs for the Settings/Updates page to identify non-admin users accessing `/settings/updates` or related endpoints. Review Coolify's audit logs (if available) for evidence of update configuration changes by unexpected users. Implement network-level restrictions to limit access to the Coolify administrative interface to trusted IP ranges or VPN. Consider role-based access control (RBAC) at the reverse proxy level if Coolify's internal controls are insufficient for your threat model.

Why prioritize this

Although the CVSS score is Medium, the vulnerability sits in update management—a function directly tied to security posture. An attacker preventing or controlling updates amplifies exposure to other threats. In multi-user Coolify environments, this should be ranked above the base CVSS score due to the operational nature of the affected component and the ease of exploitation by any authenticated user.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the following: (AV:N) the attack is network-accessible via the web interface, (AC:L) no special conditions or timing are required, (PR:L) the attacker must possess valid login credentials, (UI:N) no user interaction is needed beyond authentication, (S:U) the impact is confined to the Coolify system itself, (C:N) no confidential data is disclosed, (I:H) an attacker can alter update configurations with significant integrity implications, and (A:N) availability is not directly impacted by the flaw itself. The score appropriately penalizes the authentication requirement but reflects the severity of uncontrolled changes to system update behavior.

Frequently asked questions