The missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text.
If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can execute arbitrary commands on the remote server.

PoC

App\Livewire\Boarding\Index::$privateKey;
App\Livewire\Boarding\Index::selectExistingPrivateKey();