What is the CVSS score of EUVD-2026-60476?

EUVD-2026-60476 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokploy are affected by EUVD-2026-60476?

Dokploy versions prior to 0.29.6 contain a privilege escalation vulnerability allowing authenticated users with member:create permissions to seize permanent organizational ownership through…. A patch is available.

How to fix or mitigate EUVD-2026-60476?

Within 24 hours, immediately upgrade all Dokploy instances to version 0.29.6 or later and audit the permissions granted to all users with member:create role. Within 7 days, review authentication logs and audit trails for any unauthorized role assignments or ownership changes made during the affected period. Within 30 days, conduct a comprehensive access control audit of all organization-level permissions and implement principle-of-least-privilege controls to restrict member:create permissions to only necessary administrators.

Dokploy EUVD-2026-60476

| CVE-2026-45790 HIGH

Improper Privilege Management (CWE-269)

2026-08-17 GitHub_M

Privilege Escalation Dokploy

8.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

PR:L because member:create permission is required; UI:N because the attacker controls the invited account and no victim interaction is needed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 17, 2026 - 22:03 EUVD

Source Code Evidence Fetched

Aug 17, 2026 - 21:54 vuln.today

Analysis Generated

Aug 17, 2026 - 21:54 vuln.today

CVE Published

Aug 17, 2026 - 21:24 cve.org

HIGH 8.0

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.

AnalysisAI

Privilege escalation in Dokploy prior to version 0.29.6 allows an authenticated user with member:create permission to permanently seize organization ownership by exploiting two authorization logic flaws: the inviteMember tRPC procedure fails to restrict the role parameter to non-owner values, and the user creation service in user.ts permits arbitrary role assignment on self-hosted instances. Because owner roles cannot be demoted through normal application controls once assigned, a successful takeover is irreversible without direct database intervention. No public exploit code has been identified at time of analysis; vendor-released patch v0.29.6 closes both vulnerable code paths.

Technical ContextAI

Dokploy is an open-source, self-hosted Platform as a Service built on a Next.js and tRPC stack. The vulnerability manifests in two server-side locations: apps/dokploy/server/api/routers/organization.ts, where the inviteMember tRPC procedure validates that the caller holds member:create permission but does not validate or clamp the role value supplied in the invitation payload, allowing elevation to the owner role; and packages/server/src/services/user.ts, where a privileged self-hosted user can invoke the account creation service and supply an arbitrary role, bypassing the organization-level role hierarchy entirely. CWE-269 (Improper Privilege Management) accurately describes the root cause: the authorization check verifies the caller's permission to perform the action class but fails to constrain the privilege level of the outcome. The irreversibility stems from a missing demotion pathway for owner-role accounts in the application logic. Affected product is identified by CPE cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Dokploy v0.29.6, confirmed as the vendor-released fix at https://github.com/Dokploy/dokploy/releases/tag/v0.29.6 and fix commit a07106d649991ea09892220873ea3243766c3e08. The patch addresses both the missing role validation in the inviteMember tRPC procedure and the arbitrary role assignment vector in user.ts. If immediate upgrade is not feasible, restrict the member:create permission exclusively to fully trusted administrator accounts, accepting reduced delegation capability as a trade-off; this closes the primary invitation vector but does not address the user.ts path on self-hosted instances. Additionally, audit all organization memberships for unexpected owner-role accounts via direct database inspection - any accounts already elevated through this flaw cannot be demoted through the application UI and require direct database correction even after applying the patch.