CVE-2026-41899

Deferred Deferred - Pending Action

Authentication Bypass in Coolify Feedback API

Publication date: 2026-07-06

Last updated on: 2026-07-07

Assigner: GitHub, Inc.

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling spam, content injection, and webhook abuse. This issue is fixed in version 4.0.0-beta.474.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-07

Generated

2026-07-27

AI Q&A

2026-07-07

EPSS Evaluated

2026-07-25

NVD

CVE-2026-41899

Affected Vendors & Products

Vendor	Product	Version / Range
coolify	coolify	to 4.0.0-beta.474 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The vulnerability exists in Coolify versions prior to 4.0.0-beta.474 in the POST /api/feedback endpoint. This endpoint lacks authentication, rate limiting, and input validation, which allows anyone to send arbitrary content that is forwarded directly to a Discord webhook.

Because of this, attackers can exploit the vulnerability to spam the webhook, inject malicious content, or abuse the webhook functionality.

Detection Guidance

This vulnerability involves an unauthenticated POST request to the /api/feedback endpoint in Coolify versions prior to 4.0.0-beta.474. To detect potential exploitation or presence of this vulnerability, you can monitor network traffic or server logs for POST requests to /api/feedback.

Use tools like curl or wget to test if the endpoint accepts unauthenticated POST requests.
Example curl command to test the endpoint's accessibility: curl -X POST http://<your-coolify-server>/api/feedback -d '{"test":"data"}' -H 'Content-Type: application/json' -v
Check server access logs for POST requests to /api/feedback without authentication headers.
Use network monitoring tools (e.g., tcpdump, Wireshark) to capture and filter HTTP POST requests to /api/feedback.

Impact Analysis

This vulnerability can lead to spam and content injection through the Discord webhook, potentially causing disruption or misuse of the webhook service.

It may also result in denial of service or other availability issues due to abuse of the webhook.

Compliance Impact

The vulnerability allows unauthenticated and unchecked submission of arbitrary content to a Discord webhook, which can lead to spam, content injection, and webhook abuse.

Such uncontrolled data forwarding and lack of input validation could potentially lead to integrity issues and reputation damage, which may indirectly affect compliance with standards that require data integrity and protection against unauthorized data manipulation.

However, there is no explicit information in the provided resources about direct impacts on compliance with regulations like GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, upgrade Coolify to version 4.0.0-beta.474 or later, where the issue is fixed.

Hi! I’m here to help you understand CVE-2026-41899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70