Dokploy through version 0.30.8 is vulnerable to a cross‑organization authorization bypass in its port tRPC router. The application never verifies that a requester belongs to the organization that owns the target port or application, allowing any authenticated owner or administrator to call port.create, port.one, port.update, or port.delete with a known portId or applicationId. The result is that an attacker can read, modify, delete, or add port mappings belonging to other tenants, thereby disrupting public service exposure and potentially leaking sensitive configuration information. This flaw represents an authority escalation that can affect the confidentiality and availability of services across all organizations hosted on the same instance.

The affected product is Dokploy by Dokploy. The vulnerability exists in all releases up through and including 0.30.8. Any deployment running Dokploy 0.30.8 or earlier is susceptible.

The CVSS base score is 5.3, indicating a moderate severity. EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated owner or administrator account; an attacker only needs to supply valid identifiers for a target tenant’s port or application. Because authentication is required, the attack is limited to users within the platform, but given that many organizations have multiple privileged accounts, the risk of internal abuse remains significant. No remote code execution is possible, but the impact on cross‑tenant port management is substantial.