Self-Hosted Tool Vulnerability in Coolify Affects API Security

CVE-2026-32718

What is CVE-2026-32718?

Coolify is an open-source, self-hostable tool designed for managing servers, applications, and databases. An issue was identified in versions prior to 4.0.0-beta.466, where read ability was improperly implemented on mutating API validation endpoints. This oversight allowed read-scoped API tokens to execute state-changing operations, including the validation of cloud tokens and servers, potentially leading to unauthorized access and manipulation of critical resources. The vulnerability has been resolved in the latest version, enhancing the security of the API.

References