CVE-2026-27883: Coolify Auth Bypass Vulnerability

CVE-2026-27883 Overview

CVE-2026-27883 is a broken access control vulnerability in Coolify, an open-source, self-hostable platform for managing servers, applications, and databases. The flaw affects the GET /api/v1/deployments/{uuid} endpoint in versions prior to 4.0.0-beta.464. Any authenticated user can retrieve deployment details belonging to teams they do not belong to, bypassing team-based authorization. The endpoint extracts the $teamId from the authentication token but fails to apply it as a filter to the database query. This weakness is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The issue is fixed in Coolify 4.0.0-beta.464.

Critical Impact
Authenticated users can read deployment metadata across all tenants on the same Coolify instance, exposing multi-tenant deployment information without requiring privilege escalation.

Affected Products

Coolify versions prior to 4.0.0-beta.464
Self-hosted Coolify instances exposing the /api/v1/deployments/{uuid} endpoint
Multi-tenant Coolify deployments with more than one team

Discovery Timeline

2026-06-30 - CVE-2026-27883 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-27883

Vulnerability Analysis

Coolify exposes a REST endpoint at GET /api/v1/deployments/{uuid} that returns deployment records identified by a Universally Unique Identifier (UUID). The endpoint requires authentication and resolves the caller's $teamId from the bearer token. However, the handler queries the deployments table using only the uuid path parameter. The team identifier derived from the token is never applied as a WHERE clause condition on the query. As a result, the database returns the deployment record regardless of which team owns it. Any authenticated user with a valid token and knowledge or guess of a deployment UUID retrieves that deployment's details.

Root Cause

The root cause is a missing authorization check between the authenticated principal and the requested object. The code trusts the UUID as a sufficient access key but does not verify ownership. This is the pattern described by [CWE-639]: Authorization Bypass Through User-Controlled Key. The $teamId variable is available in scope but is not used to constrain the query.

Attack Vector

An attacker requires a valid Coolify account on the target instance. The attacker sends an authenticated GET request to /api/v1/deployments/{uuid} supplying a UUID belonging to a different team. The server returns the target deployment record, including deployment metadata that should be restricted to the owning team. Deployment UUIDs may be obtained through prior access, log exposure, referer leakage, or systematic enumeration. The attack is remote, network-based, and requires low privileges with no user interaction.

No verified exploit code is publicly available. See the GitHub Security Advisory for maintainer-provided technical details.

Detection Methods for CVE-2026-27883

Indicators of Compromise

Repeated GET /api/v1/deployments/{uuid} requests from a single authenticated user targeting many distinct UUIDs
API access logs showing successful responses where the responding deployment's team_id does not match the caller's team_id
Unusual API token usage patterns correlated with deployment enumeration attempts

Detection Strategies

Enable verbose access logging on the Coolify reverse proxy and correlate uuid path parameters with authenticated user identity
Add an application-level audit log that records the caller team_id, the target deployment team_id, and the outcome for each /api/v1/deployments/{uuid} request
Build alerts that trigger when a single principal accesses deployments belonging to more than one team within a short window

Monitoring Recommendations

Ingest Coolify API logs into a centralized log platform for retention and cross-tenant analysis
Baseline normal per-user deployment API request volumes and alert on statistically significant deviations
Monitor authentication token issuance and revoke tokens for accounts exhibiting enumeration behavior

How to Mitigate CVE-2026-27883

Immediate Actions Required

Upgrade all Coolify instances to version 4.0.0-beta.464 or later without delay
Rotate API tokens on affected instances to invalidate any tokens that may have been used for cross-tenant reads
Audit deployment access logs for the pre-patch window to identify potential unauthorized reads

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.464. The fix scopes the deployment lookup query with the caller's team_id, enforcing team-based authorization on the GET /api/v1/deployments/{uuid} endpoint. Refer to the Coolify GitHub Security Advisory GHSA-f6h4-qx26-76jv for the release details.

Workarounds

Restrict access to the Coolify API using a reverse proxy allowlist limited to trusted operators until the upgrade is applied
Temporarily reduce the number of accounts with API access to minimize the pool of authenticated principals
Segment single-tenant Coolify instances per team where multi-tenancy is not required, eliminating cross-team exposure

bash

# Example: pin Coolify to the patched version using the official installer
export COOLIFY_VERSION="4.0.0-beta.464"
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

# Verify the running version
docker inspect coolify --format '{{.Config.Image}}'