EUVD-2026-55685Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network-reachable tRPC call needs only a low-privileged authenticated member (PR:L, AC:L, UI:N); the missing tenant check crosses a security authority so S:C, exposing (C:H) and poisoning (I:H) another org's backups while availability is unaffected (A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's service host, read that organization's backup objects, or redirect and poison backups across tenant boundaries.
AnalysisAI
Cross-tenant authorization bypass in Dokploy 0.29.8 and earlier lets an authenticated organization member with backup permissions reach another organization's S3 backup destinations by supplying a client-controlled destinationId that is never checked against their active organization. Because the referenced destination's S3 accessKey and secretAccessKey are materialized on the attacker's service host, the attacker can read a victim tenant's backup objects and redirect or poison backups across tenant boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated member of a Dokploy organization on a multi-tenant instance and must hold backup permissions for at least one service in their own organization - that role is the exact prerequisite, since the vulnerable procedures (backup.create/update/restoreBackupWithLogs) are only reachable by such members. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high priority despite requiring authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker signs up for or is invited to Organization A on a shared Dokploy instance and is granted backup permissions for one of their own services. They enumerate or guess destinationId values belonging to Organization B and issue a backup.create or backup.restoreBackupWithLogs call referencing B's destination; Dokploy materializes B's S3 credentials on the attacker's service host, letting them read B's backups and redirect or poison future backups. … |
| Remediation | Upgrade to the fixed release referenced in the vendor advisory GHSA-56qv-89fq-3h2q (https://github.com/Dokploy/dokploy/security/advisories/GHSA-56qv-89fq-3h2q); an exact fixed version number was not provided in the input data, so confirm the patched version directly from that advisory before deploying - patch available per vendor advisory, released version not independently confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Dokploy deployments running 0.29.8 or earlier; audit IAM logs and S3 access logs for cross-organization access patterns; restrict backup permissions to minimal-privilege users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today