CVE-2025-64421

Name of the Vulnerable Software and Affected Versions Coolify versions up to and including 4.0.0-beta.434

Description Coolify is a self-hostable tool for managing servers, applications, and databases. A low privileged user (member) can invite a high privileged user, and subsequently gain administrative access to the Coolify instance. Specifically, despite an initial error message, repeatedly clicking the invite button allows a low privileged user to invite themselves as an administrator. Following the invitation, the attacker can initiate a password reset and log in with new administrative credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.