CVE-2026-27881: Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, GET /api/v1/deployments/{uuid} in DeployController.php retrieves deployment details without validating that the deployment belongs to the authenticated user's team. Any authenticated API user can read deployment records from other teams by providing a valid deployment UUID. This vulnerability is fixed in 4.0.0-beta.464.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.464
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27881?
The severity of CVE-2026-27881 is medium with a score of 5.
How do I fix CVE-2026-27881?
To fix CVE-2026-27881, upgrade Coolify to version 4.0.0-beta.464 or later where this vulnerability has been addressed.
What type of vulnerability is CVE-2026-27881?
CVE-2026-27881 is an IDOR (Insecure Direct Object Reference) vulnerability that allows unauthorized access to deployment details.
Who is affected by CVE-2026-27881?
Users of Coolify prior to version 4.0.0-beta.464 are affected by CVE-2026-27881.
What information can be disclosed due to CVE-2026-27881?
CVE-2026-27881 allows unauthorized users to access deployment information that does not belong to their authenticated team.