Vulnerability details

CVE-2026-34037

coollabsio coolify

Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()

CVSS 3.1

9.9Critical

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

CVSS scores

Score	Version	Source	Vector
9.9Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L`

Affected products

Vendor	Product	Versions	Source
coollabsio	coolify	< 4.0.0-beta.464	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333 x_refsource_MISC
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464 x_refsource_MISC
https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-07
Last updated: 2026-07-07
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.36%

Probability of exploitation in 30 days

30.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-639
Authorization Bypass Through User-Controlled Key