The vulnerability is a classic IDOR that allows any authenticated user to retrieve detailed information for servers and projects belonging to other teams simply by supplying their numeric identifiers. The disclosed data includes SSH keys and infrastructure details, thereby compromising confidentiality and potentially enabling further lateral movement or unauthorized deployment actions.

All installations of coollabsio:coolify running a version earlier than 4.0.0‑beta.471 are affected. This includes every release prior to that specific build, as the server and project lookup routes were not scoped to the current team at the time.

The CVSS score of 7.7 reflects a high severity due to the capacity for credential exposure. EPSS data is not provided, and the vulnerability is not in the CISA KEV catalog. An attacker only needs to be authenticated to the platform and know a valid resource identifier; no additional lateral movement or privilege escalation is required. Once the ID is guessed or enumerated, the attacker can pull sensitive server configurations and SSH keys via the existing REST endpoints, leading to potential compromise of the underlying infrastructure.