AUGUST 21, 2026
Live Feed
Back to database
Case File

CVE-2026-34050

MEDIUM · CVSS 6.5 EPSS 0.21% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-06 · Last synced 2026-08-05

CyberRota Analysis

AI-Generated

The vulnerability in Coolify allows non-admin users to access the Updates settings page due to a lack of proper access control in the Settings/Updates Livewire component prior to version 4.0.0-beta.471. This could enable unauthorized modifications to auto-update settings or trigger update checks, potentially leading to system instability or security risks. Users of affected versions should prioritize upgrading to the fixed version to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-34050
Severity
MEDIUM
CVSS
6.5
EPSS
0.21%

Original NVD Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, allowing non-admin users to access the Updates settings page and potentially modify auto-update settings or trigger update checks. This issue is fixed in version 4.0.0-beta.471.