UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59955

Sensitive information `email_change_code` leaked in `/api/v1/teams/{team_id | current}/members` API endpoint

Severity
Medium 5.7
Published
3 Jan 2026
Last changed
7 Oct 2026
Added to UpHeron
14 Oct 2026
Also known as
GHSA-927g-56xp-6427
Sources
NVD, Project advisories (GitHub)

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints allows authenticated team members to access a highly sensitive `email_change_code` from other users on…

Affected software

SoftwareAffected versions
CoolifyServers and applications · cpe:a:coollabs:coolify
  • Version 4.0.0-beta428
CoolifyServers and applications · github:coollabsio/coolify
  • Version 4.0.0-beta.428

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59955
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59955
  • GitHub Advisory Database https://github.com/advisories/GHSA-927g-56xp-6427
  • github.com https://github.com/coollabsio/coolify/security/advisories/GHSA-927g-56xp-6427