Vulnerability · Published Jan 5, 2026 · Assigned by GitHub_M

CVE-2025-59955Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint

Medium 5.7

In plain English

A medium-severity security flaw in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)5.7Medium

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allows authenticated team members to access a highly sensitive `email_change_code` from other users on the same team. This code is intended for a single-use email change verification and should be kept secret. Its exposure could enable a malicious actor to perform an unauthorized email address change on behalf of the victim. As of time of publication, no known patched versions exist.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	<= 4.0.0-beta.428

Weakness: CWE-201, CWE-212, CWE-214 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-927g-56xp-6427 x_refsource_CONFIRM