CVE-2026-34592: Coolify Team Authorization Bypass – IDOR Vulnerability Analysis

Technical summary

CVE-2026-34592 is an Insecure Direct Object Reference (IDOR) vulnerability in Coolify prior to 4.0.0-beta.471. The server and project lookup endpoints fail to enforce team-scoped authorization checks, enabling horizontal privilege escalation. An authenticated user can access resources by direct ID manipulation without proper ownership validation. The vulnerability affects the API or internal lookup logic that retrieves server and project details, allowing cross-team data exposure. The CVSS 3.1 score of 7.7 (HIGH) reflects the high confidentiality impact, low attack complexity, and cross-scope reach in multi-team environments.

Business impact

For organizations using Coolify as a multi-tenant platform or as a shared infrastructure management tool across teams, this vulnerability creates significant operational and security risks. Team isolation is a fundamental trust boundary in collaborative environments; its compromise exposes sensitive infrastructure details, credentials, database configurations, and application deployment information to unauthorized internal users. Attackers with legitimate credentials gain visibility into competitors' or partners' deployments, enabling reconnaissance for further attacks, data exfiltration planning, or sabotage. Single-tenant or isolated deployments face lower but non-zero risk if credentials are compromised.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are affected. The vulnerability applies to any Coolify deployment supporting multiple teams or users with different authorization levels. Self-hosted instances running the vulnerable version are at direct risk; cloud-hosted or SaaS instances depend on the provider's patching timeline.

Exploitability

Exploitability is moderate to high in multi-team environments. The attack requires valid authentication credentials but no elevated privileges—any authenticated user can attempt the exploit. No user interaction is needed; the attacker directly manipulates API parameters or request IDs. The attack is trivial to execute: enumerate or guess resource IDs and observe the responses. In environments with weak credential hygiene or where many users have login access, the probability of exploitation increases significantly.

Remediation

Upgrade Coolify to version 4.0.0-beta.471 or later. This version implements proper team-scoped authorization checks on server and project lookups. Apply the patch immediately in production environments supporting multiple teams or untrusted users. Verify the upgrade resolves the vulnerability by testing cross-team access attempts in a staging environment.

Patch guidance

Download and deploy Coolify 4.0.0-beta.471 or a later stable release through your deployment method (Docker, package manager, or manual update). Check the official Coolify GitHub repository and release notes for installation instructions. Test in a non-production environment first. For self-hosted instances, plan maintenance windows to minimize service disruption. If you are on a version significantly older than beta.471, ensure you follow any intermediate upgrade steps documented by the Coolify project.

Detection guidance

Monitor API access logs for unusual patterns: repeated requests to server or project endpoints with varying resource IDs from the same user, especially if those requests return data from unexpected teams. Alert on 200 responses to lookups where the requester's team ID differs from the target resource's team ID (if your logging captures this). Review application access logs for any authentication events followed by cross-team resource enumeration. Implement endpoint-level logging that captures both the requested resource ID and the authenticated user's team membership.

Why prioritize this

This vulnerability merits prompt patching due to its high CVSS score (7.7), ease of exploitation, and direct impact on the core security model of multi-team deployments. Even though it requires authentication, the low attack complexity and broad scope in team-based architectures make it a priority. Organizations relying on Coolify's team isolation for security boundaries should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects: (1) Network attack surface (AV:N), (2) Low attack complexity requiring only direct ID manipulation (AC:L), (3) Low privileges needed—any authenticated user can exploit (PR:L), (4) No user interaction required (UI:N), (5) Changed scope—the vulnerability affects team resources beyond the attacker's own scope (S:C), and (6) High confidentiality impact through unauthorized access to other teams' infrastructure data (C:H). Integrity and availability are not impacted, keeping the score from higher bands.

Frequently asked questions