CVE-2026-100744

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100744
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100744.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100744
Published
2026-09-27T01:15:13Z
Modified
2026-09-28T03:48:34Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization
Details

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.2.0 is sufficient to fix this issue. This patch is called 39ae16de4248075de8c08f3259114e064b20d52d. It is advisable to upgrade the affected component.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-862",
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100744.json"
}
References

Affected packages

Git / github.com/coollabsio/coolify

Affected ranges

Type
GIT
Repo
https://github.com/coollabsio/coolify
Events
Introduced
49656aa1edbe8aa6f7f7077dbf689cb1a08f05ee
Fixed
39ae16de4248075de8c08f3259114e064b20d52d
Fixed
b53ae426b881a1b895c4946253f8dd201a7f1747
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.1.0"
        },
        {
            "last_affected":  "4.1.0"
        },
        {
            "introduced":  "4.1.1"
        },
        {
            "last_affected":  "4.1.1"
        },
        {
            "introduced":  "4.1.2"
        },
        {
            "last_affected":  "4.1.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*
4.1.0
4.1.1
4.1.2
v4.*
v4.1.0
v4.1.1
v4.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100744.json"