The vulnerability identified as CVE-2026-41899 affects Coolify, an open-source server and application management tool. Before version 4.0.0-beta.474, the POST /api/feedback endpoint does not require authentication, nor does it implement rate limiting or input validation. This missing authentication for a critical function (CWE-306) and lack of input validation (CWE-770) allows attackers to forward arbitrary content directly to a Discord webhook configured in the system. This can lead to spam, content injection, and abuse of the webhook functionality. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. The issue is resolved in version 4.0.0-beta.474.

Unauthenticated attackers can exploit the POST /api/feedback endpoint to send arbitrary content to a Discord webhook, leading to potential spam, injection of malicious or unwanted content, and abuse of the webhook integration. This could disrupt communication channels or be used for phishing or social engineering attacks via the webhook. There is no direct confidentiality impact reported, but integrity and availability of the webhook content can be affected.

Upgrade Coolify to version 4.0.0-beta.474 or later, where this vulnerability is fixed. Since the vendor advisory or patch links are not explicitly provided, confirm the upgrade from the official Coolify release notes or repository. Until upgraded, restrict access to the /api/feedback endpoint or disable webhook integrations if possible to prevent abuse.