{"id":"CVE-2026-121587","title":"Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints","summary":"Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a rep…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-200"],"vendor":"coollabsio","product":"coolify","affected":["coolify < 4.1.1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-07T03:13:00.919667Z"},"published":"2026-11-03","updated":"2026-11-07","sourceUpdated":"2026-11-07T03:13:17.112Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121587","references":[{"url":"https://github.com/coollabsio/coolify/pull/10361"},{"url":"https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01"},{"url":"https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876"},{"url":"https://github.com/coollabsio/coolify/releases/tag/v4.1.1","label":"coolify v4.1.1 Release Notes"},{"url":"https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69"},{"url":"https://github.com/coollabsio/coolify"},{"url":"https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints","label":"VulnCheck Advisory: Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints"}],"tags":["cve.org"],"epss":0.00273,"epssPercentile":0.19815,"ingestedAt":"2026-11-05T20:33:06.280Z","slug":"CVE-2026-121587","body":"## Overview\n\nCoolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.\n\n## Affected\n\n- `coolify < 4.1.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}