CVE-2026-32718

{
  "id": "CVE-2026-32718",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T22:16:47.927",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466."
    },
    {
      "lang": "es",
      "value": "Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versión 4.0.0-beta.466, los puntos finales de validación de la API que mutan están protegidos por la capacidad de lectura, permitiendo que los tokens de API con alcance de lectura realicen operaciones que cambian el estado, como validar tokens de la nube y servidores. Este problema se soluciona en la versión 4.0.0-beta.466."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "coollabsio",
          "product": "coolify",
          "versions": [
            {
              "version": "< 4.0.0-beta.466",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-07T14:01:21.284915Z",
          "id": "CVE-2026-32718",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/pull/8893",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}