Coolify cross-team IDOR — server and project lookups not scoped to current team

Coolify is an open-source PaaS that manages servers, applications, databases, and deployments — think Heroku/Vercel you run yourself. In versions prior to 4.0.0-beta.471, the server and project lookup endpoints fail to scope queries to the requesting user's team_id. Any authenticated user with a valid session can substitute another team's server ID or project ID into the URL and read that team's resources back. CWE-639 — classic Authorization Bypass Through User-Controlled Key (IDOR). CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N reflects confidentiality-only impact but with scope change, because the data crossing the boundary belongs to a different security principal (another team).

Vendor severity HIGH (7.7) is fair *for the multi-tenant deployments that are actually affected*. The catch: most Coolify installs in the wild are single-team (a solo dev or small shop running their own apps), so the population at risk is the subset of Coolify operators who invite users from outside their trust boundary — agencies hosting client environments, internal platform teams hosting multiple product squads, etc. For those operators, the leak isn't theoretical: project objects in Coolify carry environment variables, repo URLs, and references to server connection profiles that hold SSH credentials. That's why we keep this at HIGH despite the auth requirement.

Sources.

1. Coolify GHSA — coollabsio/coolify Security Advisories
2. Coolify project — coollabsio/coolify GitHub
3. CWE-639: Authorization Bypass Through User-Controlled Key
4. The Hacker News — Coolify Discloses Critical Flaws
5. heise online — Coolify critical vulnerabilities
6. wz-it — Coolify CVE Overview 2025/2026
7. Coolify documentation
8. FIRST CVSS 3.1 specification

Run this from an auditor workstation with shell access to the Coolify host (or anywhere docker can reach the running container). Invoke as ./check_coolify.sh <coolify_container_name_or_id> — example: ./check_coolify.sh coolify. No special privileges beyond being in the docker group.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-34592 — Coolify cross-team IDOR
# Outputs: VULNERABLE / PATCHED / UNKNOWN
set -u

CONTAINER="${1:-coolify}"
FIXED="4.0.0-beta.471"

if ! command -v docker >/dev/null 2>&1; then
  echo "UNKNOWN — docker CLI not available"
  exit 2
fi

if ! docker inspect "$CONTAINER" >/dev/null 2>&1; then
  echo "UNKNOWN — container '$CONTAINER' not found"
  exit 2
fi

# Extract version from the running container. Coolify exposes /api/health and writes
# a versions.json; fall back to image tag.
VER="$(docker exec "$CONTAINER" sh -c 'cat /var/www/html/versions.json 2>/dev/null | grep -oE "\"coolify\"\s*:\s*\"[^\"]+\"" | head -1 | sed -E "s/.*:\s*\"([^\"]+)\".*/\\1/"' 2>/dev/null)"

if [ -z "$VER" ]; then
  VER="$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.version" }}' "$CONTAINER" 2>/dev/null)"
fi

if [ -z "$VER" ]; then
  VER="$(docker inspect --format '{{.Config.Image}}' "$CONTAINER" | awk -F: '{print $2}')"
fi

if [ -z "$VER" ]; then
  echo "UNKNOWN — could not determine Coolify version"
  exit 2
fi

# Lexicographic compare works for Coolify's semver-ish 4.0.0-beta.NNN scheme
# Normalize: strip leading 'v'
VER="${VER#v}"

verlte() { [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$1" ]; }

if verlte "$FIXED" "$VER"; then
  echo "PATCHED — Coolify $VER (fixed in $FIXED)"
  exit 0
else
  echo "VULNERABLE — Coolify $VER < $FIXED — upgrade to $FIXED or later"
  exit 1
fi