CVE-2026-15507

Executive Summary

CVE-2026-15507 is a critical missing authorization vulnerability in coollabsio Coolify versions up to 4.1.1. The flaw resides in the Policy Handler component, specifically within the /app/Policies/ file. An unauthenticated remote attacker can exploit this weakness to bypass authorization checks, potentially leading to unauthorized access to sensitive resources, data manipulation, or privilege escalation. The exploit is publicly available, increasing the immediate risk to unpatched instances. The CVSS score of 6.3 (Medium) reflects the potential for confidentiality, integrity, and availability impact, though the attack complexity is low and no privileges are required.

Supply Chain & Package Security

Coolify is a self-hosted application deployment platform. This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the core application logic. Users should verify the integrity of their Coolify installation and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is needed for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited information disclosure is possible.
• Integrity (I): Low – Limited data modification is possible.
• Availability (A): Low – Limited service disruption is possible.

Threat Level: Medium. The public availability of the exploit and the low attack complexity make this a significant threat for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862) . The Policy Handler in Coolify is responsible for enforcing access controls on various application resources. The flaw exists in the /app/Policies/ file, where the application fails to properly verify that the requesting user has the necessary permissions to perform the requested action.

Mechanism:

1. An attacker sends a crafted HTTP request to a specific endpoint that relies on the Policy Handler for authorization.
2. The Policy Handler, due to a logic flaw, does not validate the user's identity or permissions.
3. The request is processed as if it came from an authorized user, allowing the attacker to perform actions such as viewing, modifying, or deleting resources.

Impact:

• Unauthorized access to application data (e.g., deployment configurations, environment variables).
• Unauthorized modification of application settings.
• Potential privilege escalation if the attacker can modify user roles or permissions.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (Conceptual):

// /app/Policies/SomePolicy.php
public function view(User $user, Resource $resource)
{
    // Missing authorization check
    return true; // Always allows access
}

Patched Code (Conceptual):

// /app/Policies/SomePolicy.php
public function view(User $user, Resource $resource)
{
    // Proper authorization check
    return $user->id === $resource->user_id || $user->isAdmin();
}

The patched version ensures that only the resource owner or an administrator can access the resource.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Coolify instance (version <= 4.1.1).
• Network access to the Coolify web interface.

Exploitation Steps:

1. Identify the target Coolify instance.
2. Enumerate available endpoints that rely on the Policy Handler. Common endpoints may include:
   • /api/v1/resources/{id}
   • /api/v1/deployments/{id}
   • /api/v1/settings
3. Send a direct request to one of these endpoints without any authentication headers.
4. If the response contains sensitive data or allows modification, the vulnerability is confirmed.

Example Request (using curl):

curl -X GET http://target-coolify-instance/api/v1/resources/1

Expected Result: The server returns the resource details without requiring authentication.

Blue Team

Detection:

• Monitor for unusual access patterns to API endpoints, especially those without authentication.
• Look for requests to /api/v1/ paths that do not include a valid session token or API key.
• Alert on any successful access to resources that should be protected.

Hunting:

• Search logs for requests to /app/Policies/ or related policy files.
• Identify any requests that return a 200 OK status for endpoints that require authorization.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/v1/ endpoints without Authorization or Cookie headers.
  • Unusual GET or POST requests to resource management endpoints.
• Logs:
  • Access log entries showing successful responses (HTTP 200) to protected endpoints from unauthenticated sources.
  • Application logs containing errors related to policy evaluation or missing authorization checks.
• System:
  • Unauthorized changes to application configurations or user roles.
  • Creation of unexpected resources or deployments.

Detection Engineering

YARA Rule

rule CVE_2026_15507_Coolify_Missing_Auth
{
    meta:
        description = "Detects potential exploitation of CVE-2026-15507 in Coolify"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-15507"
    strings:
        $s1 = "/app/Policies/" ascii wide nocase
        $s2 = "Policy Handler" ascii wide nocase
        $s3 = "missing authorization" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-15507 - Coolify Missing Authorization Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting Coolify API endpoints without authentication
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15507
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/v1/'
        sc-status: 200
    filter:
        cs-headers|contains: 'Authorization'
    condition: selection and not filter
falsepositives:
    - Legitimate unauthenticated API endpoints (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-15507 - Coolify Missing Authorization Exploitation Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/v1/"; http_uri;
    pcre:"/^\/api\/v1\/(resources|deployments|settings)\//";
    sid:10000001;
    rev:1;
    reference:cve,2026-15507;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Coolify instance from untrusted networks if possible.
2. Monitor logs for signs of exploitation.
3. Apply any available patches from the vendor as soon as they are released.
4. Restrict network access to the Coolify web interface using a firewall or VPN.

Long-term Fixes:

• Update Coolify to a patched version once available.
• Implement a Web Application Firewall (WAF) to block unauthenticated requests to sensitive endpoints.
• Conduct a security audit of the application's authorization logic.
• Enable detailed logging and alerting for all API access.

Workarounds:

• If patching is not immediately possible, consider disabling the vulnerable Policy Handler component if the application allows it.
• Use reverse proxy authentication (e.g., OAuth2 Proxy) to enforce authentication at the network level.

Valters IT
DevSecOps & Cyber Threat Intelligence