CVE-2026-27956 Coolify: Cross-team application domain enumeration via domains_by_server endpoint
Authenticated users can enumerate domain names of applications belonging to other teams via an API endpoint that bypasses team scoping.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27956?
CVE-2026-27956 is a medium-severity vulnerability in coollabsio coolify, published on 30 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/{server_uuid}/domains?uuid={app_uuid}` bypasses team scoping when the optional uuid query parameter is provided. Any authenticated API user can enumerate domain names (FQDNs) of applications belonging to other teams. This vulnerability is fixed in 4.0.0-beta.464.
Weakness: CWE-639
Which versions are affected by CVE-2026-27956?
How do I fix CVE-2026-27956?
No fix has been published for CVE-2026-27956 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27956 being exploited?
There is no known exploitation of CVE-2026-27956 in the wild and no public exploit code.
Sources
Also known as GHSA-9x6p-29p3-h466.