Executive brief
Dokploy is a self-hosted platform for deploying and managing applications. An authenticated administrator or owner in one organization could delete servers, deployments, and configurations belonging to another organization, gaining access to sensitive SSH private keys and disrupting service management across organizational boundaries.
Technical details
The server.remove tRPC mutation in Dokploy accepts a caller-supplied serverId and executes deletion operations (haveActiveServices, findServerById, removeDeploymentsByServerId, deleteServer) without verifying that the target server's organizationId matches the authenticated user's activeOrganizationId. This is an insecure direct object reference (IDOR) / broken authorization flaw. An authenticated user (owner or administrator with server:delete permission) in Organization A who has previously observed a serverId from Organization B can invoke server.remove with that serverId to delete the entire server registration and deployment records, interrupt management operations, and extract plaintext SSH private keys—actions that server.one correctly denies via authorization checks. The vulnerability requires authentication and prior knowledge of a valid serverId from another organization, but affects confidentiality, integrity, and availability. Fixed in version 0.29.13.
Affected products
- Dokploy Dokploy 0.28.7 to 0.29.12
Timeline
- 2026-08-10: disclosed
- 2026-07-20: patched: Fix merged in commit 4aee66b