Xyptonize

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.466 **Description** An authenticated user with access to server Sentinel settings can execute commands on the host when Sentinel is restarted. This occurs because the `sentinel token` setting is used in shell commands without sufficient validation, allowing for the injection of shell syntax. **Recommendations** Update to version 4.0.0-beta.466.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.466 **Description** An issue exists where log drain secrets and environment values are interpolated into shell commands without sufficient encoding. This allows an authenticated user to perform command injection, resulting in the execution of arbitrary commands on the host system. **Recommendations** Update to version 4.0.0-beta.466.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.466 **Description** An authenticated user can access logs of applications belonging to other teams. This occurs because the `Logs::mount()` function retrieves resources using a UUID without verifying if the resource belongs to the user's current team, allowing unauthorized access when a victim resource UUID is provided. **Recommendations** Update to version 4.0.0-beta.466.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.466 **Description** Mutating API validation endpoints are incorrectly guarded by read permissions. This allows users with read-scoped API tokens to execute state-changing operations, such as validating servers and cloud tokens. **Recommendations** Update to version 4.0.0-beta.466.