CVE-2026-34037

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464
https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v
https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v

Configurations

No configuration.

History

07 Jul 2026, 15:16

Type	Values Removed	Values Added
References	~~() https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v -~~	() https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v -

07 Jul 2026, 04:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-07 04:17

Updated : 2026-07-07 15:16

NVD link : CVE-2026-34037

Mitre link : CVE-2026-34037

CVE.ORG link : CVE-2026-34037

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-34037", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34037", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:02:08.730195Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.464"}]}]}], "published": "2026-07-07T04:17:48.020", "references": [{"url": "https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v", "source": "security-advisories@github.com"}, {"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464."}], "lastModified": "2026-07-07T15:16:43.730", "sourceIdentifier": "security-advisories@github.com"}