CVE-2026-100744: Missing Authorization in coollabsio Coolify
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.2.0 is sufficient to fix this issue. This patch is called 39ae16de4248075de8c08f3259114e064b20d52d. It is advisable to upgrade the affected component.
AI Analysis
Technical Summary
This vulnerability in coollabsio Coolify affects versions 4.1.0, 4.1.1, and 4.1.2. It is caused by missing authorization checks in a route-level middleware function located in app/Http/Middleware/CanUpdateResource.php. The flaw allows remote attackers to bypass authorization controls. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. A patch identified by commit 39ae16de4248075de8c08f3259114e064b20d52d is available in version 4.2.0, which fixes the issue.
Potential Impact
The vulnerability allows remote attackers to bypass authorization checks, potentially enabling unauthorized access or modification of resources protected by the affected middleware. This could lead to unauthorized actions within the Coolify application. The CVSS score of 6.9 reflects a medium severity impact with network attack vector and no privileges or user interaction required.
Mitigation Recommendations
Upgrade coollabsio Coolify to version 4.2.0 or later, which contains the official fix for this missing authorization vulnerability. Applying this update fully mitigates the issue.
CVE-2026-100744: Missing Authorization in coollabsio Coolify
Description
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.2.0 is sufficient to fix this issue. This patch is called 39ae16de4248075de8c08f3259114e064b20d52d. It is advisable to upgrade the affected component.
CVSS v4.0
Score 6.9medium
Affected software
coollabsio
Coolify
pkg:github/coollabsio/coolifycpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in coollabsio Coolify affects versions 4.1.0, 4.1.1, and 4.1.2. It is caused by missing authorization checks in a route-level middleware function located in app/Http/Middleware/CanUpdateResource.php. The flaw allows remote attackers to bypass authorization controls. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. A patch identified by commit 39ae16de4248075de8c08f3259114e064b20d52d is available in version 4.2.0, which fixes the issue.
Potential Impact
The vulnerability allows remote attackers to bypass authorization checks, potentially enabling unauthorized access or modification of resources protected by the affected middleware. This could lead to unauthorized actions within the Coolify application. The CVSS score of 6.9 reflects a medium severity impact with network attack vector and no privileges or user interaction required.
Mitigation Recommendations
Upgrade coollabsio Coolify to version 4.2.0 or later, which contains the official fix for this missing authorization vulnerability. Applying this update fully mitigates the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-26T11:01:20.101Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab87268f7a7c541061e9b54
Added to database: 09/27/2026, 01:33:28 UTC
Last enriched: 09/27/2026, 01:47:40 UTC
Last updated: 09/27/2026, 03:27:02 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.