CVE-2026-34592 is an authorization bypass vulnerability in Coolify, an open-source server and application management tool. Before version 4.0.0-beta.471, Coolify does not restrict server and project lookups to the user's current team context, enabling authenticated users to access resources of other teams by manipulating resource IDs. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high confidentiality impact but no integrity or availability impact. The issue is resolved in version 4.0.0-beta.471.

An authenticated user can bypass authorization controls to access servers and projects belonging to other teams, potentially exposing sensitive information. The confidentiality of data is impacted, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Upgrade to Coolify version 4.0.0-beta.471 or later, where the vulnerability is fixed. Since the product is self-hosted, administrators should apply this update promptly to prevent unauthorized access. Patch status is not explicitly confirmed beyond the stated fixed version, so verify with the vendor advisory for any additional remediation details.