CVE-2026-34167

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471

Description The ActivityMonitor Livewire component exposes a public $activityId property that lacks the #[Locked] attribute. The system loads activities using the Activity::find() function without implementing authorization or team scoping. Because activity IDs are auto-incrementing integers, an authenticated user can enumerate activity records across all teams. This allows the unauthorized reading of full command outputs from remote SSH processes, potentially exposing secrets, configuration files, and infrastructure details.

Recommendations Update to version 4.0.0-beta.471.