CVE-2026-32718 is an incorrect authorization vulnerability (CWE-863) in Coolify, an open-source server and application management tool. Before version 4.0.0-beta.466, mutating API validation endpoints were protected only by read permissions, enabling API tokens with read scope to execute state-changing operations. This improper access control flaw allows unauthorized users with limited privileges to perform actions that should require higher authorization. The issue is resolved in version 4.0.0-beta.466.

The vulnerability allows attackers with read-scoped API tokens to perform unauthorized state-changing operations, such as validating cloud tokens and servers. This can lead to unauthorized modification of system state or configuration, impacting integrity but not confidentiality or availability. The CVSS score is 6.5 (medium severity), reflecting the moderate impact due to required privileges and lack of confidentiality or availability impact.

Upgrade to Coolify version 4.0.0-beta.466 or later, where this authorization issue is fixed. Since no official patch advisory or vendor remediation level is provided, users should verify the upgrade from the vendor's official sources. Patch status is not yet confirmed beyond the stated fixed version; check vendor advisories for current remediation guidance.