Authorization Bypass in Coolify by Coollabsio

CVE-2026-27883

What is CVE-2026-27883?

Coolify, an open-source tool for managing servers, applications, and databases, has a vulnerability that allows authenticated users to access deployment details across different teams. This occurs because the GET /api/v1/deployments/{uuid} endpoint fails to properly enforce team-based authorization, as the $teamId is drawn from the authentication token but not utilized to limit database queries. This oversight creates potential security risks and unauthorized data exposure, which has been rectified in version 4.0.0-beta.464.

References