The vulnerability allows any authenticated API user to retrieve Fully Qualified Domain Names (FQDNs) for applications that belong to teams other than the user’s own. This cross‑team enumeration of domain names is a disclosure of potentially sensitive infrastructure information. The weakness is identified as CWE‑639, which pertains to improper restriction of resources or information based on user identity.

Open‑Source Coolify deployments from coollabsio are affected. The issue exists in all releases prior to 4.0.0‑beta.464; later versions contain a fix that restores proper team scoping for the domains endpoint.

The CVSS score of 4.3 indicates moderate severity, and no EPSS score is available, suggesting limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the API, so the risk is primarily to internal users with broader access than intended. By enumerating domain names, a malicious actor could map the organization’s application landscape, aiding further targeted attacks.