CVE-2026-34037

9.9 Critique

Publiée le 07/07/2026 à 06:17 · Modifiée le 07/07/2026 à 17:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

Traduire en français

Produits concernés

coollabsio coolify

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-639

Références

https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464
https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v
https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories