CVE-2025-22611 CRITICAL

CVE-2025-22611: Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)

Vendor Coollabsio
Product coolify
Weakness CWE-862 · Missing authorization
Published January 24, 2025
Last update January 24, 2025
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able to kick every other member out of the team, including admins and owners. This allows the attacker to access the `Terminal` feature and execute remote commands. Version 4.0.0-beta.361 fixes the issue.

Key dates

02Disclosure timeline

January 24, 2025 CVE published
January 24, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-40223 WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability CVE-2022-3512 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command CVE-2026-25384 WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability CVE-2024-13637 Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation CVE-2023-48751 WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control