Executive Summary

CVE-2025-64421 is a high-severity privilege escalation vulnerability in Coolify versions up to v4.0.0-beta.434. A low privileged user (member) can exploit a flaw in the invitation process to invite themselves as an administrator. Although the application initially throws an error when a member tries to invite a new admin, clicking the invite button a second time succeeds, granting admin privileges. The attacker can then reset the password for the new admin account and gain full administrative access to the system. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with low privileged access to escalate their privileges to administrator level, leading to a full compromise of the system. The attacker can gain unauthorized administrative control, impacting the confidentiality, integrity, and availability of the system's data and operations. This can result in unauthorized access, data breaches, and potential disruption of services. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection can focus on monitoring the /team/members endpoint for repeated invite attempts by low privileged users. Specifically, look for multiple invite requests from the same member user, especially repeated clicks on the invite button. Network traffic analysis or application logs can be inspected for such patterns. However, no specific commands are provided in the resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting member-level users from accessing the invite functionality or monitoring and blocking repeated invite attempts. Since no patch is available at the time of reporting, administrators should consider limiting member privileges or disabling the invite feature temporarily to prevent privilege escalation. Additionally, monitoring for suspicious password reset requests for newly invited admin accounts is advised. [1]

Useful 0 Not Useful 0