coollabsio coolify.

Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

• coollabsio coolify
• Information disclosure

coollabsio Coolify GitHub App Setup redirect missing authentication

• coollabsio Coolify
• Authentication bypass

coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

• coollabsio Coolify
• Broken access control

Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

• coollabsio coolify
• Authentication bypass

Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

• coollabsio coolify
• Command injection

coollabsio Coolify Policy Policies authorization

• coollabsio Coolify
• Broken access control

Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

• coollabsio coolify
• Command injection

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

• coollabsio coolify
• Command injection

Coolify: Command injection via single-quote breakout in Docker Compose custom commands

• coollabsio coolify
• Command injection

Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

• coollabsio coolify
• Server-side request forgery (SSRF)

Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()

• coollabsio coolify
• Broken access control

Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers

• coollabsio coolify
• Broken access control

Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name

• coollabsio coolify
• Command injection

Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers

• coollabsio coolify
• Command injection

Coolify: SSRF via S3 Storage Endpoint in testConnection()

• coollabsio coolify
• Server-side request forgery (SSRF)

Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)

• coollabsio coolify
• Broken access control

Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)

• coollabsio coolify
• Command injection

Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs

• coollabsio coolify
• Command injection

Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value

• coollabsio coolify
• Cross-site request forgery (CSRF)

Coolify: Host RCE via Sentinel token injection

• coollabsio coolify
• Command injection

Coolify: Command injection via unsanitized persistent storage name in docker volume commands

• coollabsio coolify
• Command injection

Coolify: File Upload Without Type or Size Validation in Database Backup Restore

• coollabsio coolify
• Unrestricted file upload
• Denial of service

Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing

• coollabsio coolify
• CWE-346
• CWE-640

Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution

• coollabsio coolify
• Command injection

Coolify: Host RCE via Log Drain secret/env command injection

• coollabsio coolify
• Command injection

Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution

• coollabsio coolify
• Broken access control

Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access

• coollabsio coolify
• Authentication bypass

Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE

• coollabsio coolify
• Path traversal

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

• coollabsio coolify
• Command injection

Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor

• coollabsio coolify
• Broken access control

Coolify: Command Injection via unsanitized MongoDB collection names in database backup

• coollabsio coolify
• Command injection

Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component

• coollabsio coolify
• Command injection

Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

• coollabsio coolify
• Command injection

Coolify: Command Injection via Unescaped Version String in Docker Build

• coollabsio coolify
• Command injection

Coolify LocalFileVolume fs_path command injection enables RCE

• coollabsio coolify
• Command injection

Coolify unauthenticated feedback endpoint allows Discord webhook abuse

• coollabsio coolify
• Authentication bypass
• Denial of service

Coolify Settings/Updates Livewire component missing instance administrator authorization

• coollabsio coolify
• Broken access control

Coolify read-scoped API tokens can perform state-changing validation operations

• coollabsio coolify
• Broken access control

Coolify authenticated remote command injection leading to RCE and secret exfiltration

• coollabsio coolify
• Command injection

Coolify: Authenticated RCE via command injection in CA certificate management feature

• coollabsio coolify
• Command injection

Coolify: Cross-team application domain enumeration via domains_by_server endpoint

• coollabsio coolify
• Broken access control

Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`

• coollabsio coolify
• Command injection

Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure

• coollabsio coolify
• Broken access control

Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)

• coollabsio coolify
• Broken access control

Coolify: Timing Attack in GitLab Webhook Token Validation

• coollabsio coolify
• CWE-208

Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure

• coollabsio coolify
• Broken access control

Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management

• coollabsio coolify
• Command injection

Coolify: Authenticated Host RCE

• coollabsio coolify
• Command injection

Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret

• coollabsio coolify
• Authentication bypass

Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers

• coollabsio coolify
• Broken access control

coollabsio coolify Image Name os command injection

• coollabsio coolify
• Command injection

Coolify has host header injection in forgot password

• coollabsio coolify
• CWE-644

Colify has command injection vulnerability in project git source

• coollabsio coolify
• Command injection

Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links

• coollabsio coolify
• Authentication bypass

Rate-limit bypass on login via X-Forwarded-Host header

• coollabsio coolify
• Denial of service

Coolify has a privilege escalation - low privileged user can invite themselves as an admin user

• coollabsio coolify
• Broken access control

Coolify members can see private key of root user

• coollabsio coolify
• Hard-coded credentials

Coolify vulnerable to command injection via docker-compose.yaml parameters

• coollabsio coolify
• Command injection

Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint

• coollabsio coolify
• Information disclosure
• CWE-212

Coolify has Stored XSS in Project Name

• coollabsio coolify
• CWE-116