CVE-2026-34044
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID.
Risk Assessment
The organization is at risk of leaking sensitive data from logs of applications belonging to other teams, potentially breaking project isolation and access control.
Recommendation
Immediately update Coolify to version 4.0.0-beta.466 or later, which includes a fix that scopes resource lookup to the current team.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID. This issue is fixed in version 4.0.0-beta.466.