CVE-2026-41899
Received Received - Intake

Authentication Bypass in Coolify Feedback API

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling spam, content injection, and webhook abuse. This issue is fixed in version 4.0.0-beta.474.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-07
AI Q&A
2026-07-07
EPSS Evaluated
N/A
NVD
CVE-2026-41899

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
coolify coolify to 4.0.0-beta.474 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in Coolify versions prior to 4.0.0-beta.474 in the POST /api/feedback endpoint. This endpoint lacks authentication, rate limiting, and input validation, which allows anyone to send arbitrary content that is forwarded directly to a Discord webhook.

Because of this, attackers can exploit the vulnerability to spam the webhook, inject malicious content, or abuse the webhook functionality.

Mitigation Strategies

To mitigate this vulnerability, upgrade Coolify to version 4.0.0-beta.474 or later, where the issue is fixed.

Impact Analysis

This vulnerability can lead to spam and content injection through the Discord webhook, potentially causing disruption or misuse of the webhook service.

It may also result in denial of service or other availability issues due to abuse of the webhook.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart