CVE-2025-59955

Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint

State: Published
Severity: 5.7 Medium
Published: Jan 5, 2026
Updated: Jan 5, 2026
Reserved: Sep 23, 2025

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allows authenticated team members to access a highly sensitive `email_change_code` from other users on the same team. This code is intended for a single-use email change verification and should be kept secret. Its exposure could enable a malicious actor to perform an unauthorized email address change on behalf of the victim. As of time of publication, no known patched versions exist.

Scores

CVSS	Score	Vector	Source
4.0	5.7 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	GitHub_M

Weaknesses

CWE-201 Insertion of Sensitive Information Into Sent Data
CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
CWE-214 Invocation of Process Using Visible Sensitive Information

Affected Products

Product	Versions
coolifycoollabsio	<= 4.0.0-beta.428Affected

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-927g-56xp-6427

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.