CVE-2026-42172 describes an insufficient session expiration vulnerability (CWE-613) in coollabsio's Coolify product. Before version 4.0.0-beta.474, Sanctum API tokens issued by Coolify did not have an expiration mechanism, meaning that if a token was leaked, it could be used indefinitely until manually revoked by an administrator. This flaw allows prolonged unauthorized access via compromised tokens. The vulnerability is fixed starting with version 4.0.0-beta.474, which introduces token expiration to mitigate this risk.

The vulnerability allows an attacker who obtains a leaked Sanctum API token to maintain access to the Coolify system indefinitely, as tokens do not expire automatically. This could lead to unauthorized access to server, application, and database management functions. However, the impact is limited to confidentiality (partial information disclosure) with no direct integrity or availability impact reported. The CVSS score is low (3.1), reflecting the requirement for a leaked token and limited scope of impact.

Upgrade Coolify to version 4.0.0-beta.474 or later, where Sanctum API tokens have expiration implemented. Since this version fixes the issue, no additional mitigation is required beyond applying this update. Manual revocation of leaked tokens remains necessary for versions prior to the fix.