This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Coolify (v4.0.0-beta.361 and earlier) suffers from **Broken Access Control**. <br>๐ฅ **Consequences**: Any authenticated user can attach **any existing private key** from the instance to their own servers.โฆ
๐ก๏ธ **Root Cause**: **CWE-862: Missing Authorization**. <br>โ **Flaw**: The system fails to verify if the requesting user has permission to use specific private keys. It allows unauthorized association of resources.
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: **Coolify** by coollabsio. <br>๐ **Versions**: All versions **before 4.0.0-beta.361**. <br>๐ **Type**: Open-source, self-hosted Heroku/Netlify/Vercel alternative.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Hacker Actions**: <br>1. **Privilege Escalation**: Gain access to sensitive infrastructure keys. <br>2. **Data Theft**: Use stolen keys to access other servers/services. <br>3.โฆ
๐ **Threshold**: **LOW**. <br>โ **Auth Required**: Yes, the attacker must be an **authenticated user**. <br>โ๏ธ **Config**: No special config needed. Just valid login credentials.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฃ **Public Exploit**: **No**. <br>๐ **Status**: No PoC or wild exploitation code found in the provided data. <br>๐ **Reference**: See GitHub Advisory GHSA-3w2c-jfr2-9pg9.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: <br>1. Check your Coolify version. <br>2. If < **4.0.0-beta.361**, you are vulnerable. <br>3. Audit user permissions and private key associations in the dashboard.
Q8Is it fixed officially? (Patch/Mitigation)
๐ฉน **Fix**: **Yes**. <br>โ **Patch**: Upgrade to **Coolify 4.0.0-beta.361** or later. <br>๐ **Source**: Official GitHub Security Advisory.
Q9What if no patch? (Workaround)
๐ **No Patch?**: <br>1. **Restrict Access**: Limit authenticated users to only those who strictly need private key management. <br>2.โฆ
โ ๏ธ **Urgency**: **HIGH**. <br>๐ฅ **Priority**: **Immediate Action Required**. <br>๐ **Risk**: CVSS Score indicates High impact on Confidentiality, Integrity, and Availability. Do not delay patching.