Unrated severityNVD Advisory· Published Jan 24, 2025· Updated Jan 24, 2025
Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak
CVE-2025-22607
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UUID of the model. This exposes the "client id", "client secret" and "webhook secret." Version 4.0.0-beta.361 fixes this issue.
Affected products
1- Range: < 4.0.0-beta.361
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/coollabsio/coolify/security/advisories/GHSA-8w24-gfgq-jg72mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.