Coolify, an open‑source server and application manager, contained a flaw in its ActivityMonitor Livewire component that exposed a public property $activityId without the Livewire #[Locked] attribute. When an authenticated user assigned a value to this property, the component executed Activity::find($this->activityId) without any authorization checks or team scoping. Because activity identifiers are simple, sequential integers, a user could enumerate them to read activity records from any team. Each activity record includes the full command output from remote SSH processes, which may reveal secrets, configuration files, and other sensitive infrastructure details. The vulnerability is a classic example of CWE‑639: Lack of Authorization on a Resource.

All installations of Coolify released by Coollabs.io with versions earlier than 4.0.0‑beta.471 are affected. The issue only manifests for users who have authenticated access to the application.

The vulnerable functionality has a CVSS score of 5.0, indicating moderate severity, and an EPSS score of less than 1%, suggesting a very low exploitation probability at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated attacker who iterates over sequential activity IDs to read cross‑tenant logs; no elevated privileges or additional system access is required beyond normal application authentication. Successful exploitation would lead to confidentiality compromise of logs, potentially exposing sensitive commands, secrets, and infrastructure information.