Coolify (<= 4.1.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/coolify--4.1.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 27 Sep 2026 03:03:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMissing Authorization Vulnerability in Coolifyhttps://feed.craftedsignal.io/briefs/2026-09-coolify-missing-auth/Sun, 27 Sep 2026 03:03:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-coolify-missing-auth/Coolify versions 4.1.2 and prior contain a missing authorization vulnerability in the Route-Level Middleware component, allowing remote attackers to perform unauthorized resource updates.Coolify versions up to 4.1.2 are susceptible to a security flaw identified as CVE-2026-100744, residing within the Route-Level Middleware component. Specifically, the vulnerability exists in the app/Http/Middleware/CanUpdateResource.php file, which fails to properly enforce authorization checks when handling requests. This flaw enables a remote, unauthenticated attacker to manipulate resource access, potentially resulting in unauthorized modifications to infrastructure or application configurations managed by Coolify. Publicly available exploit material indicates that this vulnerability is actively tracked, increasing the risk of exploitation. Defenders should prioritize updating to Coolify version 4.2.0, which includes the necessary patch (commit 39ae16de4248075de8c08f3259114e064b20d52d) to resolve the missing authorization logic.

Impact

Successful exploitation allows remote actors to bypass security controls and perform unauthorized operations within the Coolify dashboard. This can lead to full compromise of managed infrastructure, unauthorized deployment of malicious services, or the manipulation of application settings, posing a critical risk to environments relying on Coolify for container orchestration and self-hosted application management.

Recommendation

  • Upgrade all instances of Coolify to version 4.2.0 or later to remediate CVE-2026-100744.
  • Audit application logs for abnormal requests directed at resource-management endpoints, particularly those attempting to trigger update middleware.
  • Review access control configurations for all managed resources to ensure unintended modifications have not been performed.
]]>highadvisoryweb-applicationvulnerabilityauthentication-bypass