Coolify versions before 4.0.0-beta.464 contain an authorization bypass vulnerability (CWE-639) in the cloneTo() Livewire action within ResourceOperations.php. While the source resource is authorized correctly, the destination resource lookup uses unscoped Eloquent queries, which do not enforce tenant boundaries. This flaw permits authenticated users to clone resources into destinations owned by other teams, resulting in cross-tenant access to resources. The vulnerability is critical with a CVSS 3.1 base score of 9.9 (Network attack vector, low complexity, requires privileges, no user interaction, scope changed, high confidentiality and integrity impact, low availability impact). The issue is resolved in version 4.0.0-beta.464.

An authenticated user can bypass authorization controls to clone resources into destinations owned by other teams, leading to unauthorized cross-tenant resource access. This compromises confidentiality and integrity of data across tenants and may allow unauthorized modification or exposure of sensitive resources. Availability impact is low. There are no known exploits in the wild at the time of publication.

Upgrade coolify to version 4.0.0-beta.464 or later, where this authorization bypass vulnerability is fixed. Patch status is not explicitly stated beyond this fix version, so users should verify with the vendor for any additional updates or guidance. No other mitigations are specified.