This vulnerability affects coollabsio Coolify up to versions 4.1.0 and 4.1.1. It stems from missing authorization checks in a function within the Policy Handler component, specifically in the /app/Policies/ directory. This flaw enables an attacker to perform unauthorized actions remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. The exploit is publicly known, but no official fix or mitigation has been disclosed by the vendor as of the publication date.

The missing authorization vulnerability allows remote attackers to manipulate the Policy Handler component without proper permission checks. This could lead to unauthorized access or modification of policy-related functionality in Coolify. The medium CVSS score reflects moderate impact, with potential for unauthorized actions but limited by the need for some privileges (PR:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been provided, users should monitor vendor communications for updates. Until a patch is available, restrict network access to the affected Coolify instances and review policy-related configurations carefully to limit exposure.