Coolify is an open‑source platform for managing servers, applications, and databases. In versions before 4.0.0‑beta.471, the ActivityMonitor Livewire component exposed a public property $activityId without the Livewire #[Locked] attribute. The component uses Activity::find($this->activityId) to load activity records, but performs no authorization checks or team scoping. Activity IDs are simple auto‑incrementing integers. Because the command output of each activity is stored in the activity record, an attacker can read the full output of remote SSH processes, which can include secrets, configuration files, and infrastructure details. The flaw is a classic example of CWE‑639: Lack of Authorization on a Resource.

All installations of Coolify released by Coollabs.io with versions earlier than 4.0.0‑beta.471 are affected. The vulnerability only manifests for users who have authenticated access to the application.

The vulnerability has a CVSS score of 5.0, indicating moderate severity, and an EPSS score of less than 1%, suggesting a very low exploitation probability at the time of this analysis. It is not listed in the CISA KEV catalog. The likely attack vector is an authenticated attacker who iterates over sequential activity IDs to read cross‑tenant logs; no elevated privileges or additional system access is required beyond normal application authentication. Based on the description, it is inferred that successful exploitation would lead to confidentiality compromise of logs, potentially exposing sensitive commands, secrets, and infrastructure information.