PT-2026-56128 · Coolify · Coolify

Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-34037

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.464

Description An authenticated user can clone resources into destinations owned by other teams and access cross-tenant resources. This occurs because the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources using unscoped Eloquent lookups, which are database queries that do not apply the necessary ownership or tenant restrictions.

Recommendations Update to version 4.0.0-beta.464.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-34037

Affected Products

Coolify

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34037 · Security Note
• https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v · Note
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464 · Note
• https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333 · Note
• https://twitter.com/CVEnew/status/2074365819396465094 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074366875266339245 · Twitter Post