The flaw allows an authenticated user to assign any value to the GitHub App api_url field; Coolify then requests without any allowlisting or private IP filtering. Because the request target can be set to internal services or cloud metadata endpoints, the application may unwittingly disclose sensitive internal data or trigger denial‑of‑service conditions on those services. The weakness is a classic server‑side request forgery, reflected in CWE‑918.

Coolify, the self‑hosted platform from coollabsio, is affected in every release prior to 4.0.0‑beta.471. Any user who has permission to configure a GitHub App source in those versions can exploit the issue.

The CVSS score of 4.3 indicates a moderate risk, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. Coolify is not listed in CISA’s KEV catalog, and no public reports of active exploitation exist. An attacker would need authenticated access with privileges to set the GitHub App configuration; once the api_url is set to an internal or cloud metadata endpoint, Coolify will perform outbound requests that bypass normal network restrictions, potentially exposing confidential data or enabling lateral movement.