CVE-2026-34037CWE-639

Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()

Critical · published July 7, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00441 · 37.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-07T03:21Z
EPSS history
Timeline
  • 07 JUL 03:21Z
    Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()
    cvelistv5