CVE-2026-100746

HIGH 7.3

coollabsio Coolify GitHub App Setup redirect missing authentication

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 4.1.1 mitigates this issue. The patch is identified as fc89e357feed5180ed1ab5eb9cb330578f025539. The affected component should be upgraded.

CWE	CWE-306 CWE-287
Vendor	coollabsio
Product	coolify
Published	Sep 27, 2026

Stay Ahead of the Next One

Get instant alerts for coollabsio coolify

Be the first to know when new high vulnerabilities affecting coollabsio coolify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

coollabsio / Coolify

4.0 4.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/410617 vuldb.com: https://vuldb.com/vuln/410617/cti vuldb.com: https://vuldb.com/cve/CVE-2026-100746 vuldb.com: https://vuldb.com/submit/897404 github.com: https://github.com/lakshayyverma/CVE-Discovery/blob/main/coolify-unauth-secret-overwrite-github-app-redirect.7z github.com: https://github.com/coollabsio/coolify/pull/10362 github.com: https://github.com/coollabsio/coolify/commit/fc89e357feed5180ed1ab5eb9cb330578f025539 github.com: https://github.com/coollabsio/coolify/releases/tag/v4.1.1 github.com: https://github.com/coollabsio/coolify/

Credits

🔍 lakshay12311 (VulDB User)