CVE-2026-56293

Capgo before 12.128.2 contains an authorization flaw in transferapp that fails to update deployhistory.ownerorg when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause...

PT-2026-56433

Capgo before 12.128.2 contains an authorization flaw in transfer app that fails to update deploy history.owner org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or...

CVE-2026-27881: Authorization Bypass Through User-Controlled Key

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, GET /api/v1/deployments/uuid in DeployController.php retrieves deployment details without validating that the deployment belongs to the authenticated user's team. Any...