CVE-2026-34171
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID. An attacker who can cause a victim to visit the crafted invitation URL can reset the victim's account password to a predictable value.
Risk Assessment
The risk is that an attacker can take over a user account, leading to unauthorized access to managed servers, applications, and databases.
Recommendation
Immediately upgrade Coolify to version 4.0.0-beta.471 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit the crafted invitation URL to reset the victim account password to a predictable value. This issue is fixed in version 4.0.0-beta.471.