CVE-2026-42172

{
  "id": "CVE-2026-42172",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-07T04:17:52.133",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed in version 4.0.0-beta.474."
    },
    {
      "lang": "es",
      "value": "Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de 4.0.0-beta.474, los tokens de la API de Sanctum no caducaban, lo que permitía que un token filtrado retuviera el acceso indefinidamente hasta que fuera revocado manualmente. Este problema está solucionado en la versión 4.0.0-beta.474."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "coollabsio",
          "product": "coolify",
          "versions": [
            {
              "version": "< 4.0.0-beta.474",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-07T13:56:57.098110Z",
          "id": "CVE-2026-42172",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/coollabsio/coolify/commit/b1a78df58efe3ac38679d18c888b5817c7f01216",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/pull/9677",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-c83f-5ph7-x8xv",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-c83f-5ph7-x8xv",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}