CVE-2026-32718

MediumCVSS 6.5

Published: 06/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

Coolify prior to version 4.0.0-beta.466 has a vulnerability where mutating API validation endpoints are guarded only by read ability. This allows read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers.

Risk Assessment

The risk is that an attacker with a read-only API token can unauthorizedly modify system state, potentially leading to data integrity violations and unexpected configuration changes.

Recommendation

Immediately update Coolify to version 4.0.0-beta.466 or later, which contains the fix for this vulnerability.

Original NVD description (English source)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466.