Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-10T18:18:51.823Z",
  "pubdate": "2026-08-10T18:18:51.823Z",
  "executiveSummary": "An access control vulnerability exists in Dokploy versions 0.28.7 through 0.29.13 within the server.remove tRPC mutation. The flaw arises due to a failure in verifying whether the target server's organization matches the active session organization of the caller. Consequently, an authenticated attacker possessing owner or administrator privileges with server:delete capabilities in one organization can supply a caller-controlled serverId belonging to a different organization. Exploitation allows unauthorized cross-organization deletion of server registrations and deployment records, service disruption of Dokploy management, and exposure of associated plaintext SSH private keys, thereby bypassing intended authorization boundaries enforced by reads such as server.one.",
  "technicalDetails": "The vulnerability resides in the apps/dokploy/server/api/routers/server.ts file, specifically within the server.remove tRPC mutation. The root cause is a missing authorization check to validate that currentServer.organizationId strictly equals ctx.session.activeOrganizationId prior to executing deletion routines. During execution, the mutation accepts a caller-controlled serverId parameter and sequentially invokes haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying tenant isolation boundaries.\nThe attack flow proceeds as follows: an authenticated attacker who has previously obtained or observed another organization's serverId interacts with the Dokploy API and issues a crafted server.remove mutation containing the foreign serverId. Because the backend fails to perform proper multi-tenant ownership validation, the application processes the deletion request against the victim organization's resources. The database records for the server registration and associated deployments are purged, disrupting Dokploy management operations for the target organization. Furthermore, the exploitation flow results in the disclosure of sensitive cryptographic material, specifically the associated plaintext SSH private key, effectively bypassing the strict security controls enforced by other endpoints like server.one which correctly deny cross-organization read operations.\nThe affected component is the server management module within Dokploy versions ranging from 0.28.7 up to and including 0.29.13. Exploitation requires authentication as an owner or administrator with server:delete permissions within a separate, legitimate organization, alongside knowledge of the target organization's serverId."
}