Read the docs
TI-2025-37343 Aliases CVE-2025-59955

Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint

Priority MEDIUM 59CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allows authenticated team members to access a highly sensitive `email_change_code` from other users on the same team. This code is intended for a single-use email change verification and should be kept secret. Its exposure could enable a malicious actor to perform an unauthorized email address change on behalf of the victim. As of time of publication, no known patched versions exist.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
coollabsiocoolifyup to 4.0.0-beta.428—No fix listedCNA
  • coolify Vendorcoollabsio Affected up to 4.0.0-beta.428 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:coollabs:coolify:4.0.0:beta428:*:*:*:*:*:*4.0.0 beta428Vulnerablecoollabsio
  • cpe:2.3:a:coollabs:coolify:4.0.0:beta428:*:*:*:*:*:* Versions 4.0.0 beta428 Vulnerable ·coollabsio

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59955

References

Exploit 1

  • TI-2025-40716 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path CVSS 4.0CRITICAL 9.4
  • TI-2025-40715 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename CVSS 4.0CRITICAL 9.4
  • TI-2025-40714 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename CVSS 4.0CRITICAL 9.4
  • TI-2025-40713 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import CVSS 4.0CRITICAL 9.4
  • TI-2025-40712 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup CVSS 3.1CRITICAL 10.0
  • TI-2025-16498 Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) CVSS 3.1CRITICAL 10.0
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences