CVE-2026-34167

MEDIUM 5.0

Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor

CVSS Score

5.0

EPSS Score

0.2%

EPSS Percentile

10th

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's #[Locked] attribute. It loads activities via Activity::find($this->activityId) with no authorization or team scoping. Activity IDs are auto-incrementing integers. Any authenticated user can enumerate activity records across all teams and read the full command output from remote SSH processes, which may include secrets, configuration files, and infrastructure details. This issue is fixed in version 4.0.0-beta.471.

CWE	CWE-639
Vendor	coollabsio
Product	coolify
Published	Jul 6, 2026
Last Updated	Jul 8, 2026

Stay Ahead of the Next One

Get instant alerts for coollabsio coolify

Be the first to know when new medium vulnerabilities affecting coollabsio coolify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

coollabsio / coolify

< 4.0.0-beta.471

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/coollabsio/coolify/security/advisories/GHSA-962v-gxmw-56hc github.com: https://github.com/coollabsio/coolify/pull/9189 github.com: https://github.com/coollabsio/coolify/commit/2729dffb3e30167c1ffd642357b7e0bb99b7d180 github.com: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471