CVE-2026-34037 | THREATINT

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

PUBLISHED Reserved 2026-03-25 | Published 2026-07-07 | Updated 2026-07-07 | Assigner GitHub_M

CRITICAL: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

< 4.0.0-beta.464

affected

References

github.com/...oolify/security/advisories/GHSA-ggrr-wrvr-x83v exploit

github.com/...oolify/security/advisories/GHSA-ggrr-wrvr-x83v

github.com/...ommit/1759a1631cd63271ebf6caa250c6d93440eaa333

github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464

cve.org (CVE-2026-34037)

nvd.nist.gov (CVE-2026-34037)

Download JSON