CyberRota Analysis
AI-GeneratedThe Logs::mount() component in Coolify versions prior to 4.0.0-beta.466 is vulnerable, allowing authenticated users to access logs from applications owned by other teams by exploiting UUID lookups without proper scoping. This poses a significant risk of unauthorized data exposure, potentially compromising sensitive information across teams. Organizations using Coolify should prioritize upgrading to the fixed version to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID. This issue is fixed in version 4.0.0-beta.466.