CVE-2026-32718: Coolify Auth Bypass Vulnerability

CVE-2026-32718 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-32718 is an authorization flaw affecting Coolify versions prior to 4.0.0-beta.466. Mutating API validation endpoints are incorrectly guarded by read-level ability checks, allowing API tokens scoped only for read access to trigger state-changing operations. Attackers with a read-scoped token can validate cloud tokens and servers, actions that should require write permissions. This weakness maps to [CWE-863: Incorrect Authorization]. The issue is fixed in version 4.0.0-beta.466.

Critical Impact
Read-scoped API tokens can invoke mutating validation endpoints in Coolify, breaking the least-privilege model and enabling unauthorized state changes against cloud tokens and managed servers.

Affected Products

Coolify versions prior to 4.0.0-beta.466
Self-hosted Coolify server management deployments
Coolify API integrations issuing read-scoped tokens

Discovery Timeline

2026-07-06 - CVE-2026-32718 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-32718

Vulnerability Analysis

Coolify exposes a REST API that enforces authorization through middleware abilities such as api.ability:read, api.ability:write, and api.ability:deploy. These abilities are attached to individual routes to enforce least-privilege access for API tokens. The validation endpoints for cloud provider tokens and servers perform state-changing operations, including outbound calls to cloud APIs and modifications to internal validation state.

Before the fix, these endpoints were bound to the api.ability:read middleware. Any token issued with read scope could therefore trigger validation logic that should be reserved for write-scoped callers. The flaw is a route-level authorization mismatch rather than a code injection or memory corruption issue.

Root Cause

The root cause is inconsistent authorization policy enforcement in routes/api.php. Mutating operations were classified as read actions because the response returns validation status rather than persisted data. This conflates HTTP semantics with actual side effects. Under [CWE-863], the application makes an authorization decision using an incorrect scope, granting more privilege than the token holder should have.

Attack Vector

An attacker who possesses or obtains a read-scoped Coolify API token can send a POST request to a validation endpoint such as /cloud-tokens/{uuid}/validate. The middleware accepts the read ability and passes the request to the controller, which then executes the validation workflow. The attack requires network access to the Coolify API and a valid low-privilege token.

php

     Route::get('/cloud-tokens/{uuid}', [CloudProviderTokensController::class, 'show'])->middleware(['api.ability:read']);
     Route::patch('/cloud-tokens/{uuid}', [CloudProviderTokensController::class, 'update'])->middleware(['api.ability:write']);
     Route::delete('/cloud-tokens/{uuid}', [CloudProviderTokensController::class, 'destroy'])->middleware(['api.ability:write']);
-    Route::post('/cloud-tokens/{uuid}/validate', [CloudProviderTokensController::class, 'validateToken'])->middleware(['api.ability:read']);
+    Route::post('/cloud-tokens/{uuid}/validate', [CloudProviderTokensController::class, 'validateToken'])->middleware(['api.ability:write']);
 
     Route::match(['get', 'post'], '/deploy', [DeployController::class, 'deploy'])->middleware(['api.ability:deploy']);
     Route::get('/deployments', [DeployController::class, 'deployments'])->middleware(['api.ability:read']);

Source: GitHub Commit c15bcd5. The patch changes the middleware for the validateToken route from api.ability:read to api.ability:write, enforcing the correct scope for mutating operations.

Detection Methods for CVE-2026-32718

Indicators of Compromise

POST requests to /api/v1/cloud-tokens/{uuid}/validate or server validation endpoints originating from tokens with only read scope.
Unexpected validation activity in Coolify logs against cloud provider tokens outside of normal administrative workflows.
Outbound API traffic from Coolify to cloud provider endpoints (AWS, DigitalOcean, Hetzner) that does not correlate with a legitimate write action.

Detection Strategies

Audit Coolify web server access logs for POST requests to any /validate endpoint and correlate the token ID with its assigned abilities.
Compare API token scope inventory against observed request methods to identify read-scoped tokens issuing state-changing calls.
Review Coolify application logs for validation events attributed to non-administrative tokens.

Monitoring Recommendations

Enable verbose API request logging on the Coolify instance and forward logs to a centralized log platform for review.
Alert on any HTTP POST, PATCH, or DELETE request served by a token whose stored ability set is limited to read.
Track first-seen source IP addresses using long-lived read tokens against sensitive validation routes.

How to Mitigate CVE-2026-32718

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.466 or later, which enforces the api.ability:write middleware on validation endpoints.
Rotate any API tokens that may have been exposed or shared with untrusted integrations while the vulnerable version was in use.
Review existing tokens and reduce scope where write access is not explicitly required.

Patch Information

The fix is contained in Coolify pull request #8893 and merged as commit c15bcd5. Full details are published in the GitHub Security Advisory GHSA-f47p-xrgc-977v. Upgrading to 4.0.0-beta.466 remediates the incorrect authorization on the validateToken route.

Workarounds

Restrict network access to the Coolify API using a reverse proxy or firewall so that only trusted management hosts can reach validation endpoints.
Revoke read-scoped API tokens that are not strictly required until the upgrade is applied.
Temporarily block POST requests to /api/v1/cloud-tokens/{uuid}/validate at the reverse proxy for tokens not associated with administrators.

bash

# Nginx example: block POST to validation endpoints pending upgrade
location ~ ^/api/v1/(cloud-tokens|servers)/[^/]+/validate$ {
    limit_except GET {
        deny all;
    }
    proxy_pass http://coolify_backend;
}