CVE-2025-59955 Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint
Authenticated team members can read sensitive email change codes from other users, potentially enabling unauthorized email address changes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59955?
CVE-2025-59955 is a medium-severity vulnerability in coollabsio coolify, published on 5 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allows authenticated team members to access a highly sensitive `email_change_code` from other users on the same team. This code is intended for a single-use email change verification and should be kept secret. Its exposure could enable a malicious actor to perform an unauthorized email address change on behalf of the victim. As of time of publication, no known patched versions exist.
Which versions are affected by CVE-2025-59955?
It affects 1 product.
Products include Coollabs Coolify.
How do I fix CVE-2025-59955?
No fix has been published for CVE-2025-59955 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-59955 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59955 exists.
Other vulnerabilities in coollabsio coolify
- CVE-2025-59157 Coolify has Git Repository RCE
- CVE-2025-64420 Coolify members can see private key of root user
- CVE-2025-66209 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
- CVE-2025-22609 Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)
- CVE-2025-22611 Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)
Sources
Also known as GHSA-927g-56xp-6427.