Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-34037Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()

Critical 9.9

In plain English

A critical-severity authorization bypass via user-controlled key in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.4%top 69.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.464

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v x_refsource_CONFIRM
https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333 x_refsource_MISC
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464 x_refsource_MISC