What is the CVSS score of EUVD-2026-55791?

EUVD-2026-55791 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dokploy are affected by EUVD-2026-55791?

Dokploy versions prior to v0.29.13 fail to enforce fine-grained access controls in WebSocket handlers, allowing authenticated organization members to escalate privileges to root terminal access and…. A patch is available.

How to fix or mitigate EUVD-2026-55791?

Within 24 hours: conduct a complete inventory of Dokploy deployments and version numbers, implement network-level restrictions on WebSocket access where feasible, and review authentication logs for suspicious terminal or log-viewing activity by low-privilege accounts. Within 7 days: upgrade all affected Dokploy instances to v0.29.13 or later. Within 30 days: complete a forensic audit of historical WebSocket handler access logs to identify any unauthorized access to restricted services, validate that fine-grained role-based access controls function correctly post-upgrade, and implement continuous monitoring and alerting on privileged terminal operations.

Dokploy EUVD-2026-55791

| CVE-2026-72883 HIGH

Missing Authorization (CWE-862)

2026-08-10 GitHub_M

Authentication Bypass Docker Dokploy

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

WebSocket is network-reachable requiring only org membership (PR:L); root terminal yields full C/I/A with no user interaction and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 21:05 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 20:03 vuln.today

Analysis Generated

Aug 10, 2026 - 20:03 vuln.today

CVE Published

Aug 10, 2026 - 19:28 cve.org

HIGH 8.8

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validate organization membership but do not enforce checkServiceAccess, accessedServerIds, or accessedServices, allowing an authenticated organization member to obtain root terminal access and read logs or statistics for restricted servers and services. This issue is fixed in version 0.29.13.

AnalysisAI

Incomplete authorization in Dokploy's WebSocket handlers prior to v0.29.13 allows any authenticated organization member to obtain root terminal access to servers and read logs or statistics for services they were explicitly denied access to. The four affected handlers (terminal.ts, docker-container-terminal.ts, docker-container-logs.ts, docker-stats.ts) verify organization membership but never call checkServiceAccess, getAccessibleServerIds, or accessedServices, nullifying all fine-grained role-based access controls. No public exploit or CISA KEV listing exists; however, the attack requires only a valid low-privilege organization account, making this a meaningful privilege escalation risk in any multi-tenant Dokploy deployment.

Technical ContextAI

Dokploy is a self-hostable Node.js PaaS that orchestrates Docker containers and remote servers, identified by CPE cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*. The vulnerability resides in four WebSocket handler modules under apps/dokploy/server/wss/: terminal.ts (host shell), docker-container-terminal.ts (container shell), docker-container-logs.ts (container log streaming), and docker-stats.ts (container statistics). Each handler authenticates the caller against the organization but omits the application's three fine-grained access-control functions - checkServiceAccess (service-level ACL), getAccessibleServerIds (server-level allowlist), and accessedServices - before establishing the session. CWE-862 (Missing Authorization) precisely describes this pattern: the identity of the caller is verified but the caller's right to access the specific resource is never checked, creating an authorization bypass within the authenticated population. The fix in PR #4865 introduces a centralized authorize.ts module exposing canAccessDockerOverWss and canAccessTerminalOverWss, which correctly compose all three checks before any WebSocket session is granted.

RemediationAI

Upgrade to Dokploy v0.29.13, the vendor-released patch that introduces centralized WebSocket authorization enforcing checkServiceAccess and getAccessibleServerIds across all four affected handlers. The release is available at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 and the underlying fix is in commit 1bc76e9e5b8a9acd14a58cd8a1828c25918f162e and 68f5afae42fca353dcb3d3bc6219ffe9e168cb91. If an immediate upgrade is not feasible, the only viable compensating control is to restrict Dokploy organization membership exclusively to users who are trusted with full server access, since all members can currently bypass service- and server-level ACLs over WebSocket. This workaround fundamentally defeats the purpose of role-based access control and must be treated as strictly temporary - do not use it as a long-term substitute for patching.