Andrasbac

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.471 **Description** The Settings/Updates Livewire component fails to verify the `isInstanceAdmin` status within its `mount()` function. This allows users without administrative privileges to access the Updates settings page, where they may trigger update checks or modify auto-update configurations. **Recommendations** Update to version 4.0.0-beta.471.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.464 **Description** An Insecure Direct Object Reference (IDOR) exists where the application retrieves deployment details without validating if the deployment belongs to the authenticated user's team. An authenticated API user can read deployment records from other teams by providing a valid `uuid` in the 'GET /api/v1/deployments/{uuid}' endpoint within DeployController.php. **Recommendations** Update to version 4.0.0-beta.464.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.464 **Description** An authenticated API user can bypass team scoping to enumerate fully qualified domain names (FQDNs) of applications belonging to other teams. This occurs when the optional `uuid` query parameter is provided to the 'GET /api/v1/servers/{server uuid}/domains?uuid={app uuid}' endpoint. **Recommendations** Update to version 4.0.0-beta.464.