PT-2026-53892 · Coolify · Coolify

Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-27956

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.464

Description An authenticated API user can bypass team scoping to enumerate fully qualified domain names (FQDNs) of applications belonging to other teams. This occurs when the optional uuid query parameter is provided to the 'GET /api/v1/servers/{server uuid}/domains?uuid={app uuid}' endpoint.

Recommendations Update to version 4.0.0-beta.464.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-27956

Affected Products

Coolify

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-27956 · Security Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-9x6p-29p3-h466 · Note
• https://twitter.com/VulmonFeeds/status/2071994367460413700 · Twitter Post