PT-2025-4593 · Coolify · Coolify

Angelej · Published 2025-01-24 · Updated 2025-01-24 · CVE-2025-22607

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.361

Description The issue is related to missing authorization in Coolify, allowing any authenticated user to access sensitive information, including client id, client secret, and webhook secret, for any GitHub or GitLab configuration by knowing the UUID of the model.

Recommendations For versions prior to 4.0.0-beta.361, update to version 4.0.0-beta.361 or later to resolve the issue. As a temporary workaround, consider restricting access to the GitHub and GitLab configuration details page to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2025-22607

GHSA-8W24-GFGQ-JG72

Affected Products

Coolify

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22607.json · Exploit
• https://github.com/coollabsio/coolify/security/advisories/GHSA-8w24-gfgq-jg72 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22607 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22607 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1882858381163000002 · Twitter Post
• https://t.me/cvedetector/16295 · Telegram Post
• https://twitter.com/CVEnew/status/1882818216277286951 · Twitter Post