coollabsio coolify up to 4.0.0-beta.428 API Endpoint members insertion of sensitive information into sent data

Summaryinfo

A vulnerability, which was classified as problematic, has been found in coollabsio coolify up to 4.0.0-beta.428. This issue affects some unknown processing of the file /api/v1/teams/{team_id}/members of the component API Endpoint. Performing a manipulation results in insertion of sensitive information into sent data. This vulnerability is known as CVE-2025-59955. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in coollabsio coolify up to 4.0.0-beta.428. It has been classified as problematic. This affects an unknown functionality of the file /api/v1/teams/{team_id}/members of the component API Endpoint. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. CWE is classifying the issue as CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. This is going to have an impact on confidentiality. The summary by CVE is:

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allows authenticated team members to access a highly sensitive `email_change_code` from other users on the same team. This code is intended for a single-use email change verification and should be kept secret. Its exposure could enable a malicious actor to perform an unauthorized email address change on behalf of the victim. As of time of publication, no known patched versions exist.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-59955 since 09/23/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/12/2026). MITRE ATT&CK project uses the attack technique T1592 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0031). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• coollabsio

Name

• coolify

Version

• 4.0.0-beta.428

Website

• Product: https://github.com/coollabsio/coolify/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion