PT-2026-1315 · Coolify · Coolify

Published 2026-01-05 · Updated 2026-01-05 · CVE-2025-59955

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Coolify versions prior to and including 4.0.0-beta.420.8

Description Coolify is a self-hostable tool for managing servers, applications, and databases. The /api/v1/teams/{team id}/members and /api/v1/teams/current/members API endpoints allow authenticated team members to access a sensitive email change code belonging to other users on the same team. This code is used for email change verification and its exposure could allow an attacker to perform an unauthorized email address change. The vulnerable parameters are team id and the user's information within the team membership data.

Recommendations Coolify versions prior to 4.0.0-beta.420.8 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-214

CWE-212

CWE-201

Related Identifiers

CVE-2025-59955

GHSA-927G-56XP-6427

Affected Products

Coolify

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59955.json · Exploit
• https://github.com/coollabsio/coolify/security/advisories/GHSA-927g-56xp-6427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59955 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59955 · Vendor Advisory
• https://twitter.com/CVEnew/status/2008251286698029500 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2008259055119224864 · Twitter Post