PT-2026-56128

CVE-2026-34037

Published

2026-07-07

Updated

2026-07-08

Description by

CVSS 3.1

9.9

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.464

Description An authenticated user can clone resources into destinations owned by other teams and access cross-tenant resources. This occurs because the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources using unscoped Eloquent lookups, which are database queries that do not apply the necessary ownership or tenant restrictions.

Recommendations Update to version 4.0.0-beta.464.

Exploitability

Exploit

Fix

Impacts

Researchers

Bugbunny-Research

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers