Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-17T22:17:14.170Z",
  "pubdate": "2026-08-17T22:17:14.170Z",
  "executiveSummary": "Dokploy prior to version 0.29.6 is affected by an authorization bypass vulnerability that enables privilege escalation and permanent organization takeover.\nThe vulnerability resides in the tRPC procedure apps/dokploy/server/api/routers/organization.ts and the user service implementation within packages/server/src/services/user.ts.\nAn authenticated user possessing limited member:create permissions can exploit this flaw to invite or create accounts assigned with an arbitrary owner role.\nBecause the application logic explicitly prevents the demotion of users assigned the owner role, successful exploitation results in complete, irreversible administrative compromise of the target organization.\nThe attack requires prior authentication within the self-hosted Platform as a Service (PaaS) environment but bypasses intended role-based access control restrictions to achieve full persistence and control.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and flawed authorization enforcement within the organization and user management services of Dokploy.\nSpecifically, the apps/dokploy/server/api/routers/organization.ts tRPC procedure fails to properly restrict the permission levels that a user holding the member:create permission can assign during the member invitation process.\nConcurrently, the helper logic in packages/server/src/services/user.ts allows a privileged self-hosted user context to generate accounts with arbitrary role assignments.\nAn attacker initiates the attack flow by authenticating to the Dokploy instance with standard credentials corresponding to an account holding the member:create capability.\nThe attacker then interacts with the organization.inviteMember tRPC procedure, crafting a request payload that specifies the assignment of the owner role to a targeted or attacker-controlled account.\nDue to the missing validation checks, the backend processes the request and successfully provisions the account with administrative owner privileges.\nFollowing this, post-exploitation impact is severe and permanent; because the application architecture dictates that owner roles cannot be demoted, the attacker secures persistent and unrevocable control over the organization resources.\nThe vulnerable component spans both the tRPC routing layer and the underlying backend user service libraries across all Dokploy installations prior to version 0.29.6."
}