Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling spam, content injection, and webhook abuse. This issue is fixed in version 4.0.0-beta.474.
Published: 2026-07-06
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Coolify’s endpoint is unauthenticated, lacks rate limiting and input validation, allowing attackers to post arbitrary content that the server forwards directly to a configured Discord webhook. This results in spam, malicious content injection, and webhook abuse. The vulnerability corresponds to CWE‑306 and CWE‑770.

Affected Systems

Coolify, the open‑source tool from all releases prior to 4.0.0‑beta.474. Any instance running an older version is vulnerable; the advisory does not list finer‑grained sub‑versions, so all earlier releases are considered at risk.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate risk. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Since no authentication or rate limiting protects the endpoint, an unauthenticated attacker can send crafted HTTP POST requests from any network‑reachable machine to repeatedly abuse or flood the Discord webhook for prolonged periods.

Generated by OpenCVE AI on July 26, 2026 at 20:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Coolify to version 4.0.0‑beta.474 or later.
  • If upgrading is not immediately possible, block or restrict access to the /api/feedback endpoint using firewall rules or reverse‑proxy authentication.
  • As a temporary measure, remove or disable the Discord webhook integration until the issue is patched.
  • Consider implementing rate limiting and input validation on the endpoint to prevent abuse.

Generated by OpenCVE AI on July 26, 2026 at 20:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Coollabsio
Coollabsio coolify
Vendors & Products Coollabsio
Coollabsio coolify

Mon, 06 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling spam, content injection, and webhook abuse. This issue is fixed in version 4.0.0-beta.474.
Title Coolify unauthenticated feedback endpoint allows Discord webhook abuse
Weaknesses CWE-306
CWE-770
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Coollabsio Coolify
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-07T14:00:31.814Z

Reserved: 2026-04-22T15:11:54.672Z

Link: CVE-2026-41899

cve-icon Vulnrichment

Updated: 2026-07-07T14:00:16.095Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T20:00:04Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function

  • CWE-770

    Allocation of Resources Without Limits or Throttling