Coolify Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Coolify versions through v4.0.0-beta.434. A low privileged user can access and use invitation links intended for administrators. By using the link before the administrator, the user can log in as an admin, thereby escalating their privileges.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling a low privileged user to gain administrative rights.

Reproduction

To reproduce this vulnerability, a low privileged user must access invitation links sent to administrators. Once the user has the link, they can use it to log in as an administrator, effectively escalating their privileges.