Executive brief
Dokploy is a self-hosted deployment platform (PaaS) that manages organization members and roles. A user with basic team member management permissions could exploit this flaw to create or invite accounts with owner privileges, granting them permanent full control over the entire organization. Since owner roles cannot be demoted, this enables complete and irreversible organizational takeover.
Technical details
The vulnerability exists in Dokploy's organization.inviteMember tRPC procedure and user creation service, which fail to properly validate role assignments. An attacker with member:create permission can invoke the inviteMember procedure to grant the owner role to invited accounts, or exploit the user creation service to assign arbitrary roles. The attack requires authenticated access to the affected tRPC endpoints but no additional user interaction. A privileged self-hosted user can create accounts with any role, bypassing role restrictions. The flaw was patched in version 0.29.6 by adding validation to prevent assigning the owner role via invitations and user creation.
Affected products
- Dokploy Dokploy prior to 0.29.6
Timeline
- 2026-08-17: disclosed
- 2026-05-22: patched: Fix released in version 0.29.6 (based on release v0.29.5 containing the fix)