CVE-2026-32718

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32718", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-13T14:33:42.825Z", "datePublished": "2026-07-06T21:04:59.845Z", "dateUpdated": "2026-07-07T14:01:24.753Z"}, "containers": {"cna": {"title": "Coolify read-scoped API tokens can perform state-changing validation operations", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v"}, {"name": "https://github.com/coollabsio/coolify/pull/8893", "tags": ["x_refsource_MISC"], "url": "https://github.com/coollabsio/coolify/pull/8893"}, {"name": "https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a", "tags": ["x_refsource_MISC"], "url": "https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a"}], "affected": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"version": "< 4.0.0-beta.466", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-06T21:04:59.845Z"}, "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466."}], "source": {"advisory": "GHSA-f47p-xrgc-977v", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T14:01:21.284915Z", "id": "CVE-2026-32718", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T14:01:24.753Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Coolify read-scoped API tokens can perform state-changing validation operations", "source": {"advisory": "GHSA-f47p-xrgc-977v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.466"}]}], "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v", "name": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coollabsio/coolify/pull/8893", "name": "https://github.com/coollabsio/coolify/pull/8893", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a", "name": "https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-06T21:04:59.845Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32718", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:01:21.284915Z"}}}], "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-07T14:01:11.119Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-32718", "state": "PUBLISHED", "dateUpdated": "2026-07-06T21:04:59.845Z", "dateReserved": "2026-03-13T14:33:42.825Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-06T21:04:59.845Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coolify", "vendor": "coollabsio", "versions": [{"status": "affected", "version": "< 4.0.0-beta.466"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.466, los puntos finales de validaci\u00f3n de la API que mutan est\u00e1n protegidos por la capacidad de lectura, permitiendo que los tokens de API con alcance de lectura realicen operaciones que cambian el estado, como validar tokens de la nube y servidores. Este problema se soluciona en la versi\u00f3n 4.0.0-beta.466."}], "id": "CVE-2026-32718", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32718", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-07T14:01:21.284915Z", "version": "2.0.3"}}]}, "published": "2026-07-06T22:16:47.927", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/commit/c15bcd56347fc8c535755791e92e4f6c2af17e3a"}, {"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/pull/8893"}, {"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.0-beta.466)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coolify", "source": "cna", "vendor": "coollabsio"}, "product": "coolify", "vendor": "coollabsio"}], "created": "2026-07-06T23:00:12.849296+00:00", "updated": "2026-08-01T18:15:04.824719+00:00", "vendors": ["coollabsio", "coollabsio$PRODUCT$coolify"]}