PT-2025-4597 · Coolify · Coolify

Angelej · Published 2025-01-24 · Updated 2025-02-05 · CVE-2025-22611

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.361

Description The issue allows any authenticated user to escalate their or other team members' privileges to any role, including the owner role. This also enables the attacker to kick every other member out of the team, including admins and owners, and access the Terminal feature to execute remote commands.

Recommendations Coolify versions prior to 4.0.0-beta.361 should be updated to version 4.0.0-beta.361 to fix the issue.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-22611

GHSA-9W72-9QWW-QJ6G

Affected Products

Coolify

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22611.json · Exploit
• https://github.com/coollabsio/coolify/security/advisories/GHSA-9w72-9qww-qj6g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-22611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22611 · Security Note
• https://twitter.com/CveFindCom/status/1882836658854187513 · Twitter Post
• https://t.me/cvedetector/16309 · Telegram Post
• https://twitter.com/angelej_dev/status/1885454205952934175 · Twitter Post
• https://twitter.com/TMJIntel/status/1885007316677718085 · Twitter Post
• https://twitter.com/CVEnew/status/1882833369446142150 · Twitter Post
• https://t.me/pentestingnews/55801 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1884437157487730950 · Twitter Post
• https://twitter.com/Dinosn/status/1884916072052031836 · Twitter Post
• https://twitter.com/Brandefense/status/1887033521060913492 · Twitter Post