CVE-2026-41899: Unauthenticated Coolify Feedback Endpoint Enables Discord Webhook Abuse

Technical summary

The POST /api/feedback endpoint in Coolify prior to 4.0.0-beta.474 suffers from a confluence of security gaps: complete lack of authentication (CWE-306), no input validation, and no rate limiting (CWE-770). This allows an unauthenticated attacker to craft arbitrary POST requests and inject unsanitized content directly into a Discord webhook URL, which then receives and displays that content. The webhook typically delivers messages to a monitoring or support channel, making this an ideal vector for content injection, spam campaigns, and service disruption. The vulnerability is network-accessible and requires no special privileges or user interaction to exploit.

Business impact

Organizations using Coolify for infrastructure management rely on Discord webhooks to deliver critical notifications—deployment alerts, system warnings, and operational status updates. An attacker exploiting this vulnerability can flood those channels with spam or inject misleading messages, eroding confidence in alert integrity and potentially causing operators to ignore legitimate critical alerts. Teams may waste time triaging false or malicious messages. If the webhook is integrated with automated response systems, malicious payloads could trigger unintended actions. Additionally, abuse of the webhook endpoint may result in rate-limiting or suspension by Discord, temporarily breaking legitimate notification delivery.

Affected systems

Coolify versions prior to 4.0.0-beta.474 are affected. Specifically, any self-hosted Coolify instance running an older beta release that exposes the /api/feedback endpoint is vulnerable. Organizations running version 4.0.0-beta.474 or later are not affected. The vulnerability applies only to Coolify itself; Discord webhooks and other downstream services are recipients of malicious payloads, not the source of the vulnerability.

Exploitability

Exploitability is straightforward. No authentication is required, the endpoint is network-accessible, and no user interaction is needed. An attacker with network access to the Coolify instance can craft a simple HTTP POST request to /api/feedback with arbitrary JSON or text content and immediately trigger a delivery to the connected Discord webhook. Automation is trivial, making large-scale spam feasible. The attack requires only knowledge of the Discord webhook URL (which may be discoverable through configuration exposure or social engineering) or the ability to reach the Coolify instance directly. No specialized tools or exploits are needed.

Remediation

Update Coolify to version 4.0.0-beta.474 or later. This release introduces authentication checks on the /api/feedback endpoint, validates and sanitizes user input before forwarding to the webhook, and enforces rate limiting to prevent abuse. After updating, verify that the Discord webhook integration continues to function and test that feedback submission now requires proper authentication. Organizations unable to update immediately should consider temporarily disabling the /api/feedback endpoint or restricting network access to it via firewall rules.

Patch guidance

Upgrade to Coolify 4.0.0-beta.474 or a later stable release as soon as possible. Because this is a beta release, test the upgrade in a non-production environment first to ensure compatibility with your deployment and any customizations. After patching, restart the Coolify service and confirm that the Discord webhook is still receiving expected notifications. If you are running a production instance on an older beta, prioritize this update within your normal change-control process, as the vulnerability has no special mitigation short of patching or network isolation.

Detection guidance

Monitor access logs for POST requests to /api/feedback from unexpected IP addresses or at unusual frequencies. Webhook logs should be reviewed for sudden spikes in message volume, malformed content, or messages that do not match your normal feedback patterns. If you have access to Coolify logs, search for error messages or warnings related to the feedback endpoint. Network detection can look for repeated POST requests with varying payloads to the /api/feedback path. Teams should also audit Discord webhook activity for anomalous message delivery timing or content inconsistent with legitimate system alerts.

Why prioritize this

This vulnerability merits timely attention due to the ease of exploitation, the operational disruption it enables, and the erosion of trust in alert channels that infrastructure teams depend on. While the CVSS score of 6.5 (Medium) reflects the lack of direct confidentiality impact, the integrity and availability consequences are real: operational communications can be poisoned, legitimate alerts may be drowned out, and downstream automation could be triggered by malicious payloads. Organizations using Coolify with Discord integrations should upgrade within days rather than weeks. Non-urgent delay is acceptable only if network access to /api/feedback is already restricted or the endpoint is disabled.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network-accessible vulnerability requiring no privilege or user interaction, but with limited scope and no confidentiality impact. Integrity and availability are degraded: attackers can inject arbitrary content (integrity) and disrupt alert delivery or trigger rate-limiting (availability). The medium rating appropriately acknowledges that while the vulnerability is easy to exploit and impacts operational security, it does not directly compromise user data, system access, or core infrastructure services outside the feedback channel itself.

Frequently asked questions