CVE-2026-57498: Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept serverid and destinationuuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.474
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57498?
CVE-2026-57498 has a critical severity score of 9.6.
How do I fix CVE-2026-57498?
To fix CVE-2026-57498, upgrade to Coolify version 4.0.0-beta.474 or later.
What does CVE-2026-57498 exploit?
CVE-2026-57498 exploits unscoped server_id and destination_uuid in Livewire components allowing unauthorized actions on other teams' servers.
Which versions of Coolify are affected by CVE-2026-57498?
CVE-2026-57498 affects Coolify versions prior to 4.0.0-beta.474.
What is the risk associated with CVE-2026-57498?
CVE-2026-57498 poses a risk of unauthorized access and potential data compromise due to its IDOR vulnerability.