PT-2026-28796 · Coolify · Coolify
CVSS v3.1
8.0
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Coolify versions prior to 4.0.0-beta.471
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. The GET '/invitations/{uuid}' endpoint allows a state-changing password reset using a known invitation
uuid. An attacker can cause a victim to visit a crafted invitation URL to reset the victim account password to a predictable value.Recommendations
Update to version 4.0.0-beta.471.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Coolify