Description

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.2.0 is sufficient to fix this issue. This patch is called 39ae16de4248075de8c08f3259114e064b20d52d. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-27T02:17:20.907Z",
  "pubdate": "2026-09-27T02:17:20.907Z",
  "executiveSummary": "A missing authorization vulnerability has been identified in Coolify versions up to 4.1.2. The flaw resides within the Route-Level Middleware component, specifically located in app/Http/Middleware/CanUpdateResource.php.\nThis vulnerability allows an unauthenticated or unauthorized remote attacker to bypass access control mechanisms when interacting with resource update functions. By exploiting this flaw, an attacker can perform unauthorized actions on resources that they should not have permission to modify.\nThe risk is critical due to the potential for unauthorized configuration changes or manipulation of resources managed by Coolify. Publicly available exploit code increases the urgency for immediate remediation. Organizations should prioritize updating to version 4.2.0 or applying the specific patch identified by hash 39ae16de4248075de8c08f3259114e064b20d52d to restore proper authorization enforcement.",
  "technicalDetails": "The vulnerability is classified as an authorization bypass, stemming from improper access control enforcement within the application's middleware layer. The root cause is located in the app/Http/Middleware/CanUpdateResource.php file, which is responsible for verifying user permissions before allowing resource update operations.\nDuring the request lifecycle, the application invokes the CanUpdateResource middleware to evaluate whether the current user possesses the necessary privileges to execute an update on a specific resource. In versions 4.1.2 and below, the middleware logic fails to correctly validate the security context or the authorization claims associated with the request.\nThe exploitation flow begins when an attacker identifies a target resource update route that is protected by the CanUpdateResource middleware. By crafting a malicious request and sending it to the vulnerable route, the attacker bypasses the internal security checks intended to restrict access. Because the middleware does not properly enforce authorization, the underlying application logic proceeds to process the request as if the user had been authenticated and authorized to perform the modification.\nThis vulnerability is reachable via remote network access, allowing an attacker to manipulate protected resources without having valid administrative or owner credentials. The lack of robust validation within the middleware effectively nullifies the resource-level security posture of the platform. Once the middleware is bypassed, the attacker can leverage the application's functionality to modify, reconfigure, or otherwise tamper with the affected resources, leading to potential data integrity loss or service disruption.\nThe vulnerability is resolved in version 4.2.0. The patch 39ae16de4248075de8c08f3259114e064b20d52d introduces the necessary logic to ensure that authorization checks are executed correctly before permitting any resource modification. Developers and administrators should treat this as a high-severity incident requiring immediate deployment of the patched code to mitigate the risk of unauthorized exploitation."
}