CVE-2026-27883: Coollabsio Coolify

Medium severity, CVSS 5.0. EPSS: 0.4% chance of exploitation in the next 30 days.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid}` endpoint allows any authenticated user to access deployment details belonging to any team, bypassing team-based authorization. The $teamId is extracted from the authentication token but never used to scope the database query. This vulnerability is fixed in 4.0.0-beta.464.

Affected products

• Coollabsio Coolify: before 4.0.0-beta.464 (fixed in 4.0.0-beta.464)

Published 2026-06-30. Last modified 2026-07-01.