This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Coolify < 4.0.0-beta.361 has a critical **Authorization Bypass**. ๐ **Consequences**: Attackers can escalate privileges to **Owner** level, gaining full control over the platform and all hosted resources.โฆ
๐ก๏ธ **CWE**: **CWE-862** (Missing Authorization). ๐ **Flaw**: The application fails to verify if a user has the right permissions before executing actions.โฆ
๐ฆ **Vendor**: coollabsio. ๐ฆ **Product**: Coolify. ๐ **Affected Versions**: All versions **before 4.0.0-beta.361**. โ **Fixed In**: Version 4.0.0-beta.361 and later.
Q4What can hackers do? (Privileges/Data)
๐ **Privileges**: Escalate from any role to **Owner**. ๐ **Data Access**: Full read/write access to all projects, servers, and configurations.โฆ
โ ๏ธ **Threshold**: **Low**. ๐ช **Auth Required**: Yes, the attacker must be an **authenticated user**. ๐ซ **No Auth Bypass**: Does not require anonymous access. ๐ฏ **Ease**: **Low Complexity (AC:L)**.โฆ
๐ซ **Public Exploit**: **No**. ๐ **PoC**: None listed in the advisory. ๐ **Wild Exploitation**: Unconfirmed. However, the logic flaw is simple, so PoCs may emerge quickly.โฆ
๐ **Check**: Verify your Coolify version in the dashboard. ๐ **Date**: Published 2025-01-24. ๐ ๏ธ **Scan**: Look for version **< 4.0.0-beta.361**.โฆ
โ **Fixed**: **Yes**. ๐ฆ **Patch**: Upgrade to **Coolify 4.0.0-beta.361** or newer. ๐ **Source**: Official GitHub Security Advisory (GHSA-9w72-9qww-qj6g). ๐ **Action**: Immediate update recommended for all beta users.
Q9What if no patch? (Workaround)
๐ก๏ธ **Workaround**: If you cannot update immediately, **restrict user creation**. ๐ฅ **Limit Access**: Only allow trusted admins. ๐ **Network**: Isolate the Coolify instance from untrusted networks.โฆ
๐ฅ **Urgency**: **CRITICAL**. ๐จ **Priority**: **P1**. โก **Reason**: CVSS Vector shows **High** impact (C:H, I:H, A:H) and **Low** complexity. ๐ข **Action**: Patch immediately. This allows any user to become the owner.โฆ