CVE-2026-34037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34037", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T15:29:04.744Z", "datePublished": "2026-07-07T03:21:52.088Z", "dateUpdated": "2026-07-07T14:02:21.731Z"}, "containers": {"cna": {"title": "Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v"}, {"name": "https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333", "tags": ["x_refsource_MISC"], "url": "https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333"}, {"name": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464", "tags": ["x_refsource_MISC"], "url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464"}], "affected": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"version": "< 4.0.0-beta.464", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-07T03:21:52.088Z"}, "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464."}], "source": {"advisory": "GHSA-ggrr-wrvr-x83v", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T14:02:08.730195Z", "id": "CVE-2026-34037", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T14:02:21.731Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34037", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:02:08.730195Z"}}}], "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T14:01:50.920Z"}}], "cna": {"title": "Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()", "source": {"advisory": "GHSA-ggrr-wrvr-x83v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.464"}]}], "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v", "name": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333", "name": "https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464", "name": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-07T03:21:52.088Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34037", "state": "PUBLISHED", "dateUpdated": "2026-07-07T14:02:21.731Z", "dateReserved": "2026-03-25T15:29:04.744Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-07T03:21:52.088Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coolify", "vendor": "coollabsio", "versions": [{"status": "affected", "version": "< 4.0.0-beta.464"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.464, la acci\u00f3n Livewire cloneTo() en ResourceOperations.PHP autoriza el recurso de origen pero resuelve los recursos de destino con b\u00fasquedas Eloquent sin \u00e1mbito, permitiendo a un usuario autenticado clonar recursos en destinos propiedad de otros equipos y acceder a recursos entre inquilinos. Este problema se solucion\u00f3 en la versi\u00f3n 4.0.0-beta.464."}], "id": "CVE-2026-34037", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34037", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-07T14:02:08.730195Z", "version": "2.0.3"}}]}, "published": "2026-07-07T04:17:48.020", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333"}, {"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464"}, {"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.0-beta.464)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coolify", "source": "cna", "vendor": "coollabsio"}, "product": "coolify", "vendor": "coollabsio"}], "created": "2026-07-07T04:30:15.832205+00:00", "updated": "2026-08-03T05:00:16.062434+00:00", "vendors": ["coollabsio", "coollabsio$PRODUCT$coolify"]}