Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes…

CVE-2026-34048 affects Coolify, an open-source self-hostable server and application management tool. Prior to version 4.0.0-beta.471, terminal WebSocket bootstrap routes only validated authentication but did not enforce proper authorization controls. This flaw allowed low-privileged team members to connect to terminal routes and execute arbitrary commands on team servers. The vulnerability represents a broken access control issue where authentication and authorization were conflated. The impact is significant as it could allow privilege escalation within a team environment. The issue has been patched in Coolify version 4.0.0-beta.471, with the fix available via a specific commit to the main repository.