CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to exploit the cloneTo() Livewire action in Coolify, enabling them to clone resources into destinations owned by other teams and access cross-tenant resources due to unscoped Eloquent lookups. This critical flaw poses a significant risk of unauthorized data exposure and resource manipulation. Organizations using versions prior to 4.0.0-beta.464 should prioritize immediate updates to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.