# CVE-2026-72737: Dokploy backup cross-organization IDOR in destination handling

Source: https://junglewise.ai/threats/cve-2026-72737-dokploy-backup-cross-organization-idor-in-destination-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72737 · Severity: critical · CVSS 9.6 · Published 2026-08-10

Dokploy is a self-hosted Platform as a Service (PaaS) that manages application deployments and backups. In version 0.29.8 and earlier, an authenticated member with backup permissions for one organization can exploit an access control flaw to read or write backups belonging to other organizations, and expose sensitive S3 credentials (access keys and secret keys) from victim tenants. This allows cross-tenant data theft, credential theft, and backup redirection attacks across organization boundaries on a shared Dokploy instance.

Technologies: [Dokploy](https://junglewise.ai/threats/technologies/dokploy). Vendors: [Dokploy](https://junglewise.ai/threats/vendors/dokploy).

## Quick answers

**Is CVE-2026-72737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72737 being exploited in the wild.

**How severe is CVE-2026-72737?** Critical severity, with a CVSS score of 9.6, published 10 August 2026.

**Which products and versions are affected?** Dokploy 0.29.8 and earlier.

**Is there a fix for CVE-2026-72737?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-72737 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-72737?** Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in Dokploy's backup API routers. The functions backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-supplied destinationId parameter and use it without verifying that the destination's organizationId matches the authenticated user's activeOrganizationId. An authenticated member with backup permissions for a service in Organization A can supply a destinationId belonging to Organization B, causing the backup operations to execute against the victim's S3 bucket. When backups run, getS3Credentials(destination) interpolates the victim organization's S3 accessKey and secretAccessKey into rclone command arguments executed on the attacker's service host, exposing those credentials and enabling the attacker to read or write the victim's backup objects. The attack requires knowledge of the target destinationId (a nanoid), but the authorization check present in the sibling listBackupFiles function is absent from the vulnerable functions.

## Affected products

- Dokploy Dokploy 0.29.8 and earlier

## Timeline

- 2026-07-21: disclosed
- 2026-08-10: advisory

## References

- [https://github.com/Dokploy/dokploy/security/advisories/GHSA-56qv-89fq-3h2q](https://github.com/Dokploy/dokploy/security/advisories/GHSA-56qv-89fq-3h2q)

## Related threats

- [Dokploy missing ownership check in application monitoring](https://junglewise.ai/threats/cve-2026-127212-dokploy-before-0-31-1-contains-a-missing-ownership-check)
- [Dokploy authorization bypass in application management](https://junglewise.ai/threats/cve-2026-116068-dokploy-through-0-30-10-contains-an-authorization-bypass)
- [Dokploy cross-organization authorization bypass in port router](https://junglewise.ai/threats/cve-2026-111331-dokploy-through-0-30-8-contains-a-cross-organization)
- [Dokploy OS command injection in patch repository read](https://junglewise.ai/threats/cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior)
- [Dokploy credential disclosure in provider APIs](https://junglewise.ai/threats/cve-2026-86059-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior)