CVE-2026-34037: Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.464
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34037?
CVE-2026-34037 has a critical severity score of 9.9.
How do I fix CVE-2026-34037?
To fix CVE-2026-34037, you should upgrade to Coolify version 4.0.0-beta.464 or later.
What can be exploited in CVE-2026-34037?
CVE-2026-34037 allows for Cross-Tenant Resource Cloning due to broken object-level authorization.
Which software is affected by CVE-2026-34037?
CVE-2026-34037 affects Coolify versions prior to 4.0.0-beta.464.
What is the impact of CVE-2026-34037?
The impact of CVE-2026-34037 includes the potential for unauthorized access to resources across different tenants.