CVE-2026-34037

Publié : 7 juillet 2026

Modifié : 7 juillet 2026

Score CVSS

9.9

CRITICAL

Description détaillée

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Références et Patchs

https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333 https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464 https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v

Dernières Vulnérabilités

CVE-2026-58315

Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.

VOIR DÉTAILS

CVE-2026-57871

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.

VOIR DÉTAILS

CVE-2026-57870

Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.

VOIR DÉTAILS