The vulnerability exists in Coolify’s cloneTo() Livewire action. Although the action verifies permission on the source resource, it fails to apply a scope check on the destination resource. As a result, an authenticated user can supply any destination identifier, causing the application to resolve resources owned by other teams and create a copy of the source. This allows the attacker to access data and configurations belonging to another tenant, leading to unauthorized data exposure. Coolify manages servers, applications, and databases as a self‑hosted web application.

CoollabsIO Coolify, versions prior to 4.0.0‑beta.464.

The CVSS base score of 9.9 marks the flaw as critical. The EPSS score of <1% indicates a very low probability of exploitation, though the vulnerability remains present. Exploitation can be achieved through the normal UI or API by specifying a target identifier belonging to another team, as the destination lookup is unscoped. The vulnerability does not require elevated privileges beyond a legitimate user. It is not listed in CISA’s KEV catalog, but the cross‑tenant nature and high severity warrant attention. Attackers who can clone resources into another tenant’s environment may gain unauthorized access to that tenant’s data.