Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can invite a high privileged user. At first, the application will throw an error, but if the attacker clicks the invite button a second time, it actually works. This way, a low privileged user can invite themselves as an administrator to the Coolify instance. After the high privileged user is invited, the attacker can initiate a password reset and log in with the new admin. As of time of publication, it is unclear if a patch is available.
INFO
Published Date :
2026-01-05T19:42:46.699Z
Last Modified :
2026-01-05T20:06:08.860Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2025-64421 vulnerability.
| Vendors | Products |
|---|---|
| Coollabs |
|
| Coollabsio |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-64421.
