CVE-2026-121587
Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.
| CWE | CWE-200 |
| Vendor | coollabsio |
| Product | coolify |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for coollabsio coolify
Be the first to know when new medium vulnerabilities affecting coollabsio coolify are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
coollabsio / coolify
0 < 4.1.1
References
github.com: https://github.com/coollabsio/coolify/pull/10361 github.com: https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01 github.com: https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876 github.com: https://github.com/coollabsio/coolify/releases/tag/v4.1.1 github.com: https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69 github.com: https://github.com/coollabsio/coolify vulncheck.com: https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints
Credits
Muhammad Shariff andrasbacsai