CVE-2026-34047

9.9 Critique

Publiée le 07/07/2026 à 06:17 · Modifiée le 07/07/2026 à 17:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.

Traduire en français

Produits concernés

coollabsio coolify

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-863

Références

https://github.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf1621cd5
https://github.com/coollabsio/coolify/pull/9169
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471
https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c
https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories