The vulnerability allows any authenticated API user to retrieve deployment data of another team through the GET /api/v1/deployments/{uuid} endpoint. This IDOR flaw (CWE‑639) leads to unintended disclosure of deployment details, such as configuration information and resource usage, without the attacker needing to compromise any user credentials.

Affected product is Coolify (coollabsio:coolify) released by Coollabsio. Versions prior to 4.0.0‑beta.464 expose deployment records to cross‑team API calls. The issue was fixed in 4.0.0‑beta.464.

The CVSS score of 5.0 indicates moderate severity. The EPSS score is not available, so the current likelihood of exploitation is unknown. This vulnerability is not listed in the CISA KEV catalog. Attackers must authenticate to the API, but the lack of ownership checks allows them to request deployment information from other teams and potentially extract sensitive data. The risk is mitigated primarily by applying the corrective patch or enforcing stricter access controls.