Dokploy CVE-2026-116068

Requires a multi-tenant or shared Dokploy deployment hosting more than one organization, and the attacker must already hold owner or admin privileges within at least one organization on that instance (PR:L) - exploitation is not possible by a fully unauthenticated outsider. The concrete trigger is supplying a foreign (cross-organization) applicationId to application tRPC procedures (saveEnvironment, updateTraefikConfig, deploy, stop) on an instance running Dokploy through 0.30.10, where the server omits the tenant-ownership check. Limiting factors: single-tenant/self-hosted instances where the operator is the only organization have no cross-tenant victim to attack, and the attacker needs valid org-level credentials plus knowledge or enumeration of target applicationId values.

This is a credible, exploit-worthy flaw rather than a CVSS-inflated non-issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges - specifically, legitimate owner/admin credentials for ANY organization on a shared Dokploy instance - with high confidentiality, integrity and availability impact to the targeted tenant (VC:H/VI:H/VA:H). The CWE-639 classification (authorization bypass via user-controlled key / IDOR) matches the description: the application trusts attacker-supplied foreign applicationId values without verifying tenant ownership, confirmed by the patch commit that adds organization-scoping checks and regression tests. No EPSS score is provided and the CVE is not in CISA KEV, so there is no quantitative exploitation-probability signal and no evidence of active exploitation; the vuln.today priority is 'this_week', consistent with a serious but not emergency issue. The main factors that temper raw severity are that exploitation requires authenticated access to the same multi-tenant Dokploy instance (PR:L, not PR:N) and that the subsequent-system impact is rated none (SC:N/SI:N/SA:N), so damage is scoped to co-tenant applications on the shared instance. Overall: a real priority for anyone running Dokploy in multi-tenant/shared mode, lower urgency for single-tenant self-hosted deployments.

On a shared Dokploy instance hosting multiple organizations, an attacker who legitimately owns or administers their own (possibly free/trial) organization authenticates and calls application tRPC procedures such as saveEnvironment, updateTraefikConfig, deploy, or stop while passing another tenant's applicationId. Because the server does not verify that the referenced application belongs to the caller's active organization, the attacker overwrites a victim tenant's environment variables and build secrets, repoints the source repository, or stops/redeploys the victim's application. A public PoC reference exists (vendor GitHub issue #5635 and the VulnCheck advisory); it is not verified as working exploit code.