Insecure API Endpoint in Coolify Affects Deployment Data Access
CVE-2026-27881

5MEDIUM

Key Information:

Vendor

Coollabsio

Status
Coolify
Vendor
CVE Published:
30 June 2026

What is CVE-2026-27881?

Coolify, an open-source tool for managing servers, applications, and databases, has a security flaw that allows authenticated users to access deployment details from other teams. Specifically, prior to version 4.0.0-beta.464, the GET /api/v1/deployments/{uuid} endpoint did not validate whether the requested deployment UUID belonged to the user's team. This oversight permits any authenticated API user to retrieve sensitive deployment records, posing a significant threat to team integrity and data privacy. The issue has been resolved in the latest version.

Affected Version(s)

coolify < 4.0.0-beta.464

References

https://github.com/coollabsio/coolify/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.