This vulnerability allows an authenticated user from one team to deploy applications to servers managed by another team by manipulating URL query parameters that lack proper ownership validation. The missing check enables unauthorized deployments, potentially giving the attacker control over those servers and exposing sensitive data. This is a classic "Insecure Direct Object Reference" flaw (CWE-639).

All releases of Coolify by coollabsio before version 4.0.0‑beta.474 are affected. The issue stems from Livewire components that accepted `server_id` and `destination_uuid` without verifying that the server belongs to the requesting team.

The vulnerability carries a CVSS score of 9.6, indicating critical severity, and is not listed in CISA's KEV catalog. Exploitation requires only the ability to craft a URL to an unused deployment endpoint; the attack vector is the web UI. An attacker can supply a valid `server_id` and `destination_uuid` for a target team’s server, bypassing ownership checks, and deploy code or resources that run with the server’s privileges. The evidence suggests a straightforward, low-barrier attack that relies on standard authenticated access to the UI.