CVE-2026-34171CWE-352

Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value

High · published July 7, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit the crafted invitation URL to reset the victim account password to a predictable value. This issue is fixed in version 4.0.0-beta.471.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-07-07T03:07Z
EPSS history
Timeline
  • 07 JUL 03:07Z
    Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value
    cvelistv5