CVE-2025-64421 Coollabs CVE debrief

Who should care

Coolify administrators and users with low privileges should assess exposure and verify current version. Ensure that users with low privileges cannot invite high-privileged users. Operators, platform administrators, and security teams managing Coolify instances should prioritize verifying their version, restricting user invitations, and monitoring for suspicious activity related to user privileges.

Why it matters

CVE-2025-64421 is a high-severity vulnerability in Coolify that allows low-privileged users to invite high-privileged users, potentially leading to privilege escalation. Defenders should verify current version, restrict user invitations, and monitor for suspicious activity.

• Verify current Coolify version and assess exposure
• Restrict user invitations to prevent privilege escalation
• Monitor for suspicious activity
• Update to patched version if available

Technical summary

Coolify is an open-source tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low-privileged user can invite a high-privileged user by exploiting an error in the invitation process. This allows the low-privileged user to invite themselves as an administrator and gain elevated privileges, potentially leading to unauthorized access and control of the Coolify instance. The vulnerability emphasizes the importance of robust user management and access controls.

Defensive priority

Coolify administrators and users with low privileges should assess exposure and verify current version. Ensure that users with low privileges cannot invite high-privileged users.

Recommended defensive actions

• Verify current Coolify version and assess exposure to CVE-2025-64421
• Restrict user invitations to prevent unauthorized privilege escalation
• Monitor for suspicious activity related to user invitations and privilege changes
• Update to patched version if available, following vendor guidance
• Review compensating controls for exposed systems while remediation is scheduled
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on this vulnerability. Additional details are available in the source reference from GitHub. The vulnerability has been reported in Coolify versions up to and including v4.0.0-beta.434. Users should verify their current version and assess exposure. The source reference provides further context on the vulnerability and potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.