Executive brief
Dokploy is a self-hosted Platform as a Service (PaaS) that manages application deployments and backups. In version 0.29.8 and earlier, an authenticated member with backup permissions for one organization can exploit an access control flaw to read or write backups belonging to other organizations, and expose sensitive S3 credentials (access keys and secret keys) from victim tenants. This allows cross-tenant data theft, credential theft, and backup redirection attacks across organization boundaries on a shared Dokploy instance.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in Dokploy's backup API routers. The functions backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-supplied destinationId parameter and use it without verifying that the destination's organizationId matches the authenticated user's activeOrganizationId. An authenticated member with backup permissions for a service in Organization A can supply a destinationId belonging to Organization B, causing the backup operations to execute against the victim's S3 bucket. When backups run, getS3Credentials(destination) interpolates the victim organization's S3 accessKey and secretAccessKey into rclone command arguments executed on the attacker's service host, exposing those credentials and enabling the attacker to read or write the victim's backup objects. The attack requires knowledge of the target destinationId (a nanoid), but the authorization check present in the sibling listBackupFiles function is absent from the vulnerable functions.
Affected products
- Dokploy Dokploy 0.29.8 and earlier
Timeline
- 2026-07-21: disclosed
- 2026-08-10: advisory