CVE-2026-57498

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474

Description Multiple Livewire web UI components fail to validate team ownership when processing server id and destination uuid passed via URL query parameters. While API controllers correctly use the Server::whereTeamId($teamId) function to verify ownership, the lack of similar checks in the web UI allows users to perform cross-team resource deployment, granting unauthorized access to server, application, and database operations. Over 183,000 potentially affected devices have been identified worldwide.

Recommendations Update to version 4.0.0-beta.474.