CVE-2026-57498: Coolify Cross-Team Authorization Bypass (IDOR) in Livewire UI Components
Coolify, a self-hostable tool for managing servers and applications, has a cross-team authorization flaw in several Livewire web UI components. These components accept server and destination identifiers from URL query parameters without team ownership checks, which allows cross-team resource deployment. The GitHub advisory source rates it critical (CVSS 3.1 base score 9.6), it is fixed in 4.0.0-beta.474, and no confirmed exploitation appears in the sources consulted.
Overview
Coolify is an open-source, self-hostable tool for managing servers, applications and databases. According to the GitHub advisory, its API controllers check server ownership against the user's team before acting, but several Livewire web UI components accept server and destination identifiers from URL query parameters without that check. The result is a cross-team authorization gap, classified as CWE-639, that is fixed in 4.0.0-beta.474.
Impact
The flaw permits cross-team resource deployment. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, which describes a network-reachable issue with low attack complexity, low required privileges, no user interaction, a changed scope and high confidentiality and integrity impact.
- Confidentiality and integrity impacts are rated high in the vector.
- Availability impact is rated none in the vector.
- The PR:L component indicates that some low-privilege access is required.
Affected products and versions
The affected product is Coolify. The description states that versions prior to 4.0.0-beta.474 are affected. The structured affected list in the record is empty, so the exact range of earlier releases is not confirmed beyond that statement.
Exploitation status
The record does not list this vulnerability in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.0038 with a percentile of 0.30149, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Upgrade Coolify to 4.0.0-beta.474 or a later release that includes the fix.
- Until the upgrade is applied, restrict access to the web interface to trusted users and networks.
- Review team memberships and recent cross-team deployments for unexpected activity.
- Consult the GitHub security advisory for maintainer guidance.
Detection guidance
- Audit deployment and configuration actions and confirm that the target server or destination belongs to the acting user's team.
- Review web UI activity for identifiers that do not match the team of the requesting user.
- Correlate application logs with team membership records to identify ownership mismatches.
Limitations of the available information
The record has no structured list of affected or fixed versions beyond the description, no detailed vendor remediation notes and no information on public exploit availability. The CVSS data comes from the GitHub Security Advisories source, and the record status is Deferred. Whether the flaw can be reached without any account is unknown.
Frequently asked questions
Is this Coolify vulnerability fixed?
According to the record description, it is fixed in version 4.0.0-beta.474. Versions prior to that release are described as affected.
Is CVE-2026-57498 being exploited in the wild?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Upgrade Coolify to 4.0.0-beta.474 or a later release, and limit access to the web interface until the upgrade is complete.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.