CVE-2026-41899
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Coolify prior to version 4.0.0-beta.474, the POST /api/feedback endpoint lacks authentication, rate limiting, and input validation. This allows arbitrary content to be forwarded directly to a Discord webhook, enabling spam, content injection, and webhook abuse.
Risk Assessment
The organization is exposed to spam and social engineering attacks via Discord, as well as potential reputation damage and webhook overload, which can disrupt communication.
Recommendation
Immediately update Coolify to version 4.0.0-beta.474 or later, which includes a fix addressing the missing authentication and validation.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling spam, content injection, and webhook abuse. This issue is fixed in version 4.0.0-beta.474.