Coolify vulnerabilities

Coolify prior to version 4.0.0-beta.464 has a vulnerability in the `GET /api/v1/deployments/{uuid}` endpoint that does not validate whether the deployment belongs to the authenticated user's team. Any authenticated API user can read deployment details from other teams by providing a valid deployment UUID.

In Coolify prior to version 4.0.0-beta.471, server and project lookups are not scoped to the current team. An authenticated user can access servers and projects belonging to other teams by specifying their IDs directly.

In Coolify prior to 4.0.0-beta.474, the HMAC key for GitHub webhooks can be null, causing an empty string to be used as the key. An attacker can compute a valid signature and trigger unauthorized deployments.

In Coolify prior to 4.0.0-beta.470, a critical authenticated remote code execution (RCE) vulnerability was found. The flaw is in the handling of the install_command parameter, which is directly concatenated into a shell command during Nixpacks build, allowing arbitrary command execution on the host.

In Coolify prior to version 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with network management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without sanitization, enabling full remote code execution.

A remote code execution vulnerability in Coolify versions prior to v4.0.0-beta.420.7 allows authenticated users with low-level privileges to inject arbitrary shell commands via the Git Repository field during project creation, leading to full server compromise.

A remote code execution vulnerability in Coolify prior to v4.0.0-beta.420.6 allows authenticated low-privilege users to inject malicious Docker Compose directives during project creation, mounting the host filesystem and gaining full root access.