Threats tagged 'ghsa-3r7m-vx77-m833'

Coolify versions before 4.1.1 have an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams. This is achieved by exploiting unescaped LIKE wildcards in manual GitHub, GitLab, Bitbucket, and Gitea webhooks, enabling attackers to send crafted repository names and retrieve matching application names before signature verification.