CVE-2026-15507: Coolify Authorization Bypass Vulnerability

CVE-2026-15507 Overview

CVE-2026-15507 is a missing authorization vulnerability affecting coollabsio Coolify versions up to 4.1.1. The flaw resides in an unspecified function within the /app/Policies/ directory, which is part of the Policy Handler component. An attacker with low privileges can remotely manipulate policy handling to bypass authorization controls. The weakness is classified under CWE-862: Missing Authorization. Public exploit details have been released, increasing the risk of opportunistic abuse against exposed Coolify deployments used for self-hosted application and infrastructure management.

Critical Impact
Authenticated remote attackers can bypass policy checks in Coolify to access resources or perform actions outside their intended authorization scope.

Affected Products

coollabsio Coolify versions up to and including 4.1.1
Coolify Policy Handler component (/app/Policies/)
Self-hosted Coolify instances exposed to authenticated users

Discovery Timeline

2026-07-12 - CVE-2026-15507 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15507

Vulnerability Analysis

Coolify implements resource-level authorization through policy classes stored under /app/Policies/. These classes are expected to gate access to controllers and actions for tenants, teams, and resources such as servers, applications, and databases. CVE-2026-15507 stems from a policy stub or handler that does not enforce the authorization check it should implement. When the affected policy function is invoked, the request proceeds without validating whether the requesting principal has the required permission.

Because the flaw is in the authorization layer rather than input handling, exploitation does not require crafted payloads. A logged-in low-privilege user can trigger the vulnerable code path through normal application requests. The result is a broken access control condition consistent with [CWE-862], allowing limited disclosure or modification of resources managed by Coolify.

Root Cause

The root cause is a missing authorization guard in a policy handler under /app/Policies/. Referenced discovery material describes the issue as "resource policy stubs," indicating stub methods that return an allow decision or omit permission validation entirely. Any controller relying on the affected policy inherits the missing check.

Attack Vector

The attack vector is network-based and requires low privileges but no user interaction. An authenticated attacker sends standard HTTP requests to Coolify endpoints backed by the vulnerable policy. The Policy Handler returns an authorized decision even when the actor should be denied, granting access to protected functionality.

No verified proof-of-concept code is reproduced here. Technical details are available through the GitHub CVE Discovery Resource and the VulDB entry for CVE-2026-15507.

Detection Methods for CVE-2026-15507

Indicators of Compromise

Authenticated HTTP requests from low-privilege accounts targeting Coolify resource endpoints for servers, applications, databases, or teams they do not own.
Access log entries showing successful HTTP 200 responses on policy-protected routes without corresponding authorization failures.
Unexpected changes to Coolify resources performed by accounts lacking the associated role or team membership.

Detection Strategies

Review Coolify application logs and correlate the authenticated user identity with the resource owner or team on every mutating request.
Instrument the Laravel policy layer with logging that records the policy class, method, decision, and subject for each authorization check.
Alert on any user account accessing more distinct resource IDs within a short window than is typical for its role.

Monitoring Recommendations

Forward Coolify web server and application logs to a centralized platform and retain them for post-incident review.
Monitor for outbound connections initiated by Coolify-managed workloads that deviate from established baselines, which may indicate abuse of newly accessible resources.
Track administrative and API token activity, and rotate credentials that show anomalous access patterns.

How to Mitigate CVE-2026-15507

Immediate Actions Required

Upgrade Coolify to a version released after 4.1.1 that addresses the missing authorization in /app/Policies/.
Restrict network access to the Coolify management interface to trusted administrators and VPN or bastion networks.
Audit all Coolify user accounts, remove unused accounts, and enforce least-privilege role assignments.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Administrators should monitor the coollabsio Coolify GitHub repository and the VulDB advisory for a security release addressing the Policy Handler flaw, then upgrade promptly once available.

Workarounds

Place Coolify behind an authenticating reverse proxy or identity-aware gateway to limit which users can reach the vulnerable endpoints.
Temporarily disable or restrict low-privilege user accounts and shared team memberships until a patched version is deployed.
Review custom policy classes under /app/Policies/ and ensure every policy method explicitly returns a boolean decision based on ownership or role checks rather than relying on stubbed defaults.

bash

# Example: restrict Coolify management port to an internal admin network
sudo ufw default deny incoming
sudo ufw allow from 10.0.0.0/24 to any port 8000 proto tcp
sudo ufw reload