CVE-2026-27881 Details
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/deployments/{uuid}` in DeployController.php retrieves deployment details without validating that the deployment belongs to the authenticated user's team. Any authenticated API user can read deployment records from other teams by providing a valid deployment UUID. This vulnerability is fixed in 4.0.0-beta.464.
A cross-team information disclosure vulnerability has been identified in Coolify versions prior to 4.0.0-beta.464. The issue arises in the DeployController's 'GET /api/v1/deployments/{uuid}' endpoint, which retrieves deployment details without verifying if the deployment belongs to the authenticated user's team. This flaw allows any authenticated API user to access deployment records from other teams by providing a valid deployment UUID. The exposed deployment data includes application and server identifiers, deployment details, and the current deployment status.
Users can upgrade to Coolify version 4.0.0-beta.464 or later to address this vulnerability. The recommended fix involves adding team ownership validation to the 'GET /api/v1/deployments/{uuid}' endpoint, ensuring that only users from the relevant team can access the deployment details.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coollabsio/coolify/security/advisories/GHSA-5p5w-h58c-2h5m | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/coollabsio/coolify/security/advisories/GHSA-5p5w-h58c-2h5m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coollabsio/coolify | <= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |