CVE-2026-34171 is a CSRF vulnerability in coollabsio's Coolify product affecting versions before 4.0.0-beta.471. The vulnerability exists because the GET /invitations/{uuid} endpoint can perform a state-changing password reset operation without proper CSRF protections. An attacker who can cause a victim to visit a maliciously crafted invitation URL with a known UUID can reset the victim's password to a predictable value. This enables unauthorized account takeover. The vulnerability is resolved in version 4.0.0-beta.471.

Successful exploitation allows an unauthenticated attacker to reset a victim's account password by leveraging CSRF on the invitation endpoint. This leads to full account compromise with high confidentiality and integrity impact. Availability is not affected. The CVSS 3.1 base score is 8.0 (High), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and scope change.

Upgrade to version 4.0.0-beta.471 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid clicking on untrusted invitation URLs and restrict exposure to invitation UUIDs.