Goal Reached Thanks to every supporter โ€” we hit 100%!

Goal: 1000 CNY ยท Raised: 1336 CNY

100%

CVE-2025-22609 โ€” AI Deep Analysis Summary

CVSS 10.0 ยท Critical

Q1What is this vulnerability? (Essence + Consequences)

๐Ÿšจ **Essence**: Coolify (v4.0.0-beta.361 and earlier) suffers from **Broken Access Control**. <br>๐Ÿ’ฅ **Consequences**: Any authenticated user can attach **any existing private key** from the instance to their own servers.โ€ฆ

Q2Root Cause? (CWE/Flaw)

๐Ÿ›ก๏ธ **Root Cause**: **CWE-862: Missing Authorization**. <br>โŒ **Flaw**: The system fails to verify if the requesting user has permission to use specific private keys. It allows unauthorized association of resources.

Q3Who is affected? (Versions/Components)

๐Ÿ“ฆ **Affected**: **Coolify** by coollabsio. <br>๐Ÿ“… **Versions**: All versions **before 4.0.0-beta.361**. <br>๐ŸŒ **Type**: Open-source, self-hosted Heroku/Netlify/Vercel alternative.

Q4What can hackers do? (Privileges/Data)

๐Ÿ•ต๏ธ **Hacker Actions**: <br>1. **Privilege Escalation**: Gain access to sensitive infrastructure keys. <br>2. **Data Theft**: Use stolen keys to access other servers/services. <br>3.โ€ฆ

Q5Is exploitation threshold high? (Auth/Config)

๐Ÿ”“ **Threshold**: **LOW**. <br>โœ… **Auth Required**: Yes, the attacker must be an **authenticated user**. <br>โš™๏ธ **Config**: No special config needed. Just valid login credentials.

Q6Is there a public Exp? (PoC/Wild Exploitation)

๐Ÿ’ฃ **Public Exploit**: **No**. <br>๐Ÿ“ **Status**: No PoC or wild exploitation code found in the provided data. <br>๐Ÿ” **Reference**: See GitHub Advisory GHSA-3w2c-jfr2-9pg9.

Q7How to self-check? (Features/Scanning)

๐Ÿ” **Self-Check**: <br>1. Check your Coolify version. <br>2. If < **4.0.0-beta.361**, you are vulnerable. <br>3. Audit user permissions and private key associations in the dashboard.

Q8Is it fixed officially? (Patch/Mitigation)

๐Ÿฉน **Fix**: **Yes**. <br>โœ… **Patch**: Upgrade to **Coolify 4.0.0-beta.361** or later. <br>๐Ÿ”— **Source**: Official GitHub Security Advisory.

Q9What if no patch? (Workaround)

๐Ÿ›‘ **No Patch?**: <br>1. **Restrict Access**: Limit authenticated users to only those who strictly need private key management. <br>2.โ€ฆ

Q10Is it urgent? (Priority Suggestion)

โš ๏ธ **Urgency**: **HIGH**. <br>๐Ÿ”ฅ **Priority**: **Immediate Action Required**. <br>๐Ÿ“‰ **Risk**: CVSS Score indicates High impact on Confidentiality, Integrity, and Availability. Do not delay patching.