PT-2026-28101

CVE-2026-27883

Published

2026-03-25

Updated

2026-07-01

Description by

CVSS 3.1

5.0

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.464

Description An authorization bypass allows any authenticated user to access deployment details belonging to any team. The issue occurs because the GET /api/v1/deployments/{uuid} endpoint fails to use the $teamId extracted from the authentication token to scope the database query.

Recommendations Update to version 4.0.0-beta.464.

Exploitability

Exploit

Fix

Impacts

Researchers

Q1Uf3Ng

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers