CVE-2026-34037

critical · 9.9

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

9.9

CVSS

0.4%

EPSS (exploit prob.)

38th

EPSS percentile

2026-07-07

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weaknesses

CWE-639

References

https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464
https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v
https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-34037