Vulnerability · Published Jan 5, 2026 · Assigned by GitHub_M

CVE-2025-64423Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links

High 7.7

In plain English

A high-severity improper authentication in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can see and use invitation links sent to an administrator. When they use the link before the legitimate recipient does, they are able to log in as an administrator, meaning they have successfully escalated their privileges. As of time of publication, it is unclear if a patch is available.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	<= 4.0.0-beta.434

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-4fqm-797g-7m6j x_refsource_CONFIRM