CVE-2026-27883— Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.464 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-27883
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure
Source: NVD (National Vulnerability Database)
Vulnerability Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid}` endpoint allows any authenticated user to access deployment details belonging to any team, bypassing team-based authorization. The $teamId is extracted from the authentication token but never used to scope the database query. This vulnerability is fixed in 4.0.0-beta.464.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
CoolLabs Coolify 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
coolLabs Coolify是coolLabs团队开源的一个开源和自托管的 Heroku/Netlify/Vercel 替代品。 CoolLabs Coolify 4.0.0-beta.464之前版本存在授权问题漏洞，该漏洞源于未正确对数据库查询进行基于团队的授权范围限制，导致经过身份验证的用户可通过GET /api/v1/deployments/{uuid}端点绕过团队授权访问任何团队的部署详情。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| coollabsio | coolify | < 4.0.0-beta.464 | - |
II. Public POCs for CVE-2026-27883
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27883
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-27883 (1)
Same Patch Batch · coollabsio · 2026-06-30 · 6 CVEs total
| CVE-2026-27957 | 8.8 HIGH | Coolify: Authenticated RCE via command injection in CA certificate management feature |
| CVE-2026-27955 | 6.6 MEDIUM | Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()` |
| CVE-2026-27881 | 5.0 MEDIUM | Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} ( |
| CVE-2026-27882 | 4.8 MEDIUM | Coolify: Timing Attack in GitLab Webhook Token Validation |
| CVE-2026-27956 | 4.3 MEDIUM | Coolify: Cross-team application domain enumeration via domains_by_server endpoint |
IV. Related Vulnerabilities
Same product: coolify
- CVE-2026-27957
Coolify: Authenticated RCE via command injection in CA certi - CVE-2026-27956
Coolify: Cross-team application domain enumeration via domai - CVE-2026-27955
Coolify: Command Injection via Single-Quote Breakout in `exe - CVE-2026-27881
Coolify: Cross-team deployment information disclosure via GE - CVE-2026-27882
Coolify: Timing Attack in GitLab Webhook Token Validation
Same vendor: coollabsio
- CVE-2026-27957
Coolify: Authenticated RCE via command injection in CA certi - CVE-2026-27956
Coolify: Cross-team application domain enumeration via domai - CVE-2026-27955
Coolify: Command Injection via Single-Quote Breakout in `exe - CVE-2026-27881
Coolify: Cross-team deployment information disclosure via GE - CVE-2026-27882
Coolify: Timing Attack in GitLab Webhook Token Validation
Same weakness: CWE-639
- CVE-2026-28740
Gitea LFS object reuse bypasses Code-unit authorization - CVE-2026-27657
Gitea email settings allow changing another user's primary e - CVE-2026-25782
Gitea tracked-time deletion can target entries from another - CVE-2026-14608
SourceCodester CET Automated Grading System with AI Predicti - CVE-2026-59234
Authorization Bypass Through User-Controlled Key in Prospero
V. Comments for CVE-2026-27883
No comments yet