CVE-2026-27883: Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the GET /api/v1/deployments/{uuid} endpoint allows any authenticated user to access deployment details belonging to any team, bypassing team-based authorization. The $teamId is extracted from the authentication token but never used to scope the database query. This vulnerability is fixed in 4.0.0-beta.464.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.464
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27883?
CVE-2026-27883 has a medium severity rating of 5.
How does CVE-2026-27883 affect the security of the Coolify application?
CVE-2026-27883 allows authenticated users to access deployment details belonging to any team, leading to unauthorized information disclosure.
How do I fix CVE-2026-27883 in my Coolify installation?
To mitigate CVE-2026-27883, upgrade your Coolify installation to version 4.0.0-beta.464 or later.
What type of vulnerability is CVE-2026-27883?
CVE-2026-27883 is categorized as an Insecure Direct Object Reference (IDOR) vulnerability.
Can CVE-2026-27883 be exploited remotely?
Yes, CVE-2026-27883 can be exploited remotely as it involves an authenticated API endpoint.