EUVD-2026-33361Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.19.0 and earlier, the protectedProcedure middleware only verifies the user is authenticated - it does NOT enforce organization scoping. Each endpoint must individually verify the resource's org matches the session's activeOrganizationId. This affects the following endpoints: allByType, killProcess, and removeDeployment in deployment.ts; delete in rollbacks.ts; create, one, update, remove, manualBackupPostgres, MySql, Mariadb, Mongo, Compose, WebServer, and listBackupFiles in backup.ts; list, one, delete, update, runManually, and restoreVolumeBackupWithLogs in volume-backups.ts; getNodes, removeWorker, addWorker, and addManager in cluster.ts; and create in mount.ts.
AnalysisAI
Missing organization-level authorization in Dokploy 0.19.0 and earlier allows authenticated users from one organization to access, modify, and delete resources belonging to other organizations on the same instance. The shared protectedProcedure middleware confirms session authentication but never validates that the requested resource belongs to the caller's active organization, exposing 22 endpoints spanning deployments, backups, volume operations, cluster management, and mounts to cross-organization abuse. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Technical ContextAI
Dokploy is a self-hostable open-source PaaS built on a tRPC-based API stack where middleware procedures control endpoint access. The protectedProcedure middleware is designed as a shared authentication gate but omits organization scoping entirely - it confirms the caller holds a valid session token but never compares the resource's owning organization against the session's activeOrganizationId. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) flaw, also classified as Broken Object-Level Authorization (BOLA) or IDOR. Because each tRPC procedure must individually enforce org-context checks and the shared middleware does not, the vulnerability propagates to all 22 endpoints that rely on it: allByType, killProcess, and removeDeployment in deployment.ts; delete in rollbacks.ts; create, one, update, remove, manualBackupPostgres, MySql, Mariadb, Mongo, Compose, WebServer, and listBackupFiles in backup.ts; list, one, delete, update, runManually, and restoreVolumeBackupWithLogs in volume-backups.ts; getNodes, removeWorker, addWorker, and addManager in cluster.ts; and create in mount.ts. The affected CPE is cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* covering all versions up to and including 0.19.0.
RemediationAI
The primary remediation is to upgrade Dokploy beyond version 0.19.0; consult the GitHub Security Advisory at https://github.com/Dokploy/dokploy/security/advisories/GHSA-f8wj-5c4w-frhg for the specific patched release, as an exact fix version was not confirmed in the available data at time of analysis. For multi-tenant operators who cannot immediately upgrade, isolating each organization into its own dedicated Dokploy instance eliminates the cross-organization attack surface entirely, at the cost of increased operational overhead and resource duplication. Restricting Dokploy API access to trusted internal networks or VPN reduces the network-accessible exposure (CVSS AV:N) but does not address insider or compromised-account scenarios where the attacker already has a valid session. As a detection measure, operators should audit API logs for calls to the affected endpoints - allByType, killProcess, removeDeployment, backup operations, volume-backup operations, cluster node management endpoints, and mount creation - where the requesting user's organization does not match the resource's owning organization. Single-organization Dokploy instances have no cross-org data at risk and may deprioritize patching, though the authorization gap remains.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today