EUVD-2026-60476Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
PR:L because member:create permission is required; UI:N because the attacker controls the invited account and no victim interaction is needed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.
AnalysisAI
Privilege escalation in Dokploy prior to version 0.29.6 allows an authenticated user with member:create permission to permanently seize organization ownership by exploiting two authorization logic flaws: the inviteMember tRPC procedure fails to restrict the role parameter to non-owner values, and the user creation service in user.ts permits arbitrary role assignment on self-hosted instances. Because owner roles cannot be demoted through normal application controls once assigned, a successful takeover is irreversible without direct database intervention. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation of the primary vector requires the attacker to hold an authenticated Dokploy organization account that has been explicitly granted the member:create permission, and to control a second email address or account capable of receiving and accepting an owner-role invitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) is broadly consistent with the vulnerability description but the UI:R metric warrants scrutiny: because the attacker controls both the invoking account and the invited account, the 'user interaction' is performed by the attacker themselves rather than an unwitting victim, making UI:N arguably more accurate and raising the effective score toward 8.8. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privilege Dokploy organization account with member:create permission issues a crafted POST to the inviteMember tRPC endpoint, setting the role field to 'owner' for an email address they control. After accepting the invitation through that second account, the attacker possesses irrevocable owner-level privileges over the entire organization and all its resources. … |
| Remediation | Upgrade to Dokploy v0.29.6, confirmed as the vendor-released fix at https://github.com/Dokploy/dokploy/releases/tag/v0.29.6 and fix commit a07106d649991ea09892220873ea3243766c3e08. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately upgrade all Dokploy instances to version 0.29.6 or later and audit the permissions granted to all users with member:create role. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today