What’s Vulnerable › Vulnerabilities

CVE-2026-57498: Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-29 · updated 2026-10-25
• Weakness: CWE-639

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.

Affected products

• coollabsio coolify: before 4.0.0-beta.474

References

• https://github.com/coollabsio/coolify/security/advisories/GHSA-725v-f5gh-22q9
• https://github.com/coollabsio/coolify/security/advisories/GHSA-725v-f5gh-22q9

Get alerted when CVE-2026-57498 or the next vulnerability affects your stack