Privilege Escalation Vulnerability in Coolify by Coollabs
CVE-2025-22611

10CRITICAL

Key Information:

Vendor

Coollabsio

Status
Coolify
Vendor
CVE Published:
24 January 2025

What is CVE-2025-22611?

Coolify, an open-source tool for managing servers and applications, has a vulnerability that allows authenticated users to escalate their privileges to any role, including the owner role. This flaw also permits the unauthorized removal of other team members, including admins. Consequently, attackers can exploit this vulnerability to access critical features like the Terminal, potentially executing arbitrary remote commands. The issue has been resolved in version 4.0.0-beta.361.

Affected Version(s)

coolify < 4.0.0-beta.361

References

https://github.com/coollabsio/coolify/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.