Coolify heeft een Privilege Escalation - gebruikers met lage privileges kunnen admin uitnodigingslinks zien en gebruiken

The primary impact of CVE-2025-64423 is the potential for unauthorized privilege escalation. A member user, possessing limited access within a Coolify instance, can effectively become an administrator by exploiting the invitation link mechanism. This grants them complete control over the Coolify environment, including the ability to manage servers, applications, and databases. The attacker could modify configurations, access sensitive data, deploy malicious applications, or compromise the underlying infrastructure. This vulnerability represents a significant security risk for organizations relying on Coolify for self-hosting.

Organizations utilizing Coolify for self-hosting their applications and databases are at risk. Specifically, deployments where member users have access to administrative functions or where invitation links are not carefully managed are particularly vulnerable. Shared hosting environments using Coolify also face increased risk due to the potential for cross-tenant exploitation.

• docker: Inspect running containers for Coolify versions prior to 4.0.0. Use docker ps and docker exec -it <container_id> /bin/bash to check the version. • generic web: Monitor Coolify logs for unusual login attempts or activity related to invitation link usage. Look for patterns indicating a user logging in with elevated privileges after a short period of time. • generic web: Check for unusual processes running within the Coolify container that might indicate a compromised account.

1. 2026-01-05Disclosure

   disclosure

1. Gereserveerd2025-11-03
2. Gepubliceerd2026-01-05
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-64423 is to upgrade Coolify to version 4.0.0 or later, which contains the fix. If upgrading immediately is not feasible, consider temporarily disabling the invitation link feature or implementing stricter access controls around invitation link generation and distribution. Monitor Coolify logs for suspicious activity related to invitation link usage. While a direct workaround is not available, careful monitoring and access control practices can reduce the risk until a full upgrade can be performed. After upgrading, confirm the fix by attempting to intercept and use an invitation link as a low-privileged user; the login attempt should fail.