The vulnerability exists in Coolify’s cloneTo() Livewire action. Although the action verifies permission on the source resource, it fails to apply a scope check on the destination resource. As a result, an authenticated user can supply any destination identifier, causing the application to resolve resources owned by other teams and create a copy of the source. This allows the attacker to access data and configurations belonging to another tenant, leading to unauthorized data exposure. Coolify manages servers, applications, and databases as a self‑hosted web application.

CoollabsIO Coolify, versions prior to 4.0.0‑beta.464.

The CVSS base score of 9.9 marks the flaw as critical, while the EPSS score of <1% indicates a very low probability of exploitation. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an authenticated user can trigger the cloneTo() Livewire action through the application’s web interface by supplying a destination resource identifier belonging to another team. If an API endpoint exists for this action, it may be exploitable in a similar manner. The vulnerability does not require elevated privileges beyond a legitimate user and allows cross‑tenant cloning, thus exposing sensitive data belonging to other tenants.