Broken access control in Dokploy docker-container-terminal WebSocket (CVE-2026-72864)

The local branch of the `/docker-container-terminal` WebSocket endpoint in Dokploy authenticates connections using `validateRequest` but performs no authorization check against the caller's role, organization, or service access before passing the attacker-controlled `containerId` to `docker exec`. Any authenticated user, including the lowest-privilege member role, can obtain a root shell in arbitrary containers on a self-hosted instance, exposing platform database credentials, secrets, and breaking tenant isolation. Affected versions: - v0.29.8 We recommend updating to: v0.29.13. CVSS 9.9 · our assessment: act_now Reference: https://github.com/Dokploy/dokploy/security/advisories/GHSA-899j-cjwp-v4gw Details: https://vuln.today/cve/CVE-2026-72864