Critical · published January 24, 2025
🚨 A sneaky missing authorization lets any Coolify user elevate their privileges—like a bartender suddenly becoming the owner of the bar! 🔥 Imagine a team in a restaurant where any waiter could not only take over as head chef but also kick out the manager—chaos would ensue! This vulnerability lets an authenticated user escalate to the owner role and even remove other team members from the server management team. An attacker could potentially gain full control over the server management tool, executing commands remotely and disrupting all operations. They could kick out admins and owners, resulting in an absolute power shift that could lead to devastating data breaches or service outages.
Imagine a team in a restaurant where any waiter could not only take over as head chef but also kick out the manager—chaos would ensue! This vulnerability lets an authenticated user escalate to the owner role and even remove other team members from the server management team. This critical vulnerability in Coolify allows for privilege escalation due to a missing authorization check, enabling any authenticated user to elevate their role and manipulate team access without restrictions.
An attacker could potentially gain full control over the server management tool, executing commands remotely and disrupting all operations. They could kick out admins and owners, resulting in an absolute power shift that could lead to devastating data breaches or service outages. Upgrade Coolify to version 4.0.0-beta.361 immediately to patch this vulnerability. Review your access controls and ensure proper role assignments to minimize future risks. Regularly audit your user roles to catch any anomalies before they become a problem. You've got this! With these steps, you'll reinforce your server management fortress in no time! 🛡️