Technical impact
Dokploy through 0.30.10 contains an authorization bypass that allows an owner or admin of any organization to control applications belonging to other organizations by supplying a foreign applicationId in the tRPC request. Attackers can invoke procedures such as saveEnvironment, updateTraefikConfig, deploy, or stop, enabling them to overwrite environment variables and build secrets, reconfigure source repositories, and cause service disruptions for affected tenants. This flaw essentially gives an authenticated user administrative control over resources they do not own, compromising confidentiality, integrity, and availability of neighboring tenants’ deployments.
Affected Systems
Dokploy by Dokploy, versions up to and including 0.30.10. The vulnerability exists in the application router handling tRPC calls and the permission service that validate organization ownership. Any instance of Dokploy running 0.30.10 or earlier is affected.
Risk and Exploitability
With a CVSS score of 8.7, this vulnerability is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The attacker must first authenticate as an owner or admin of at least one organization, which is usually a legitimate credential. From there, the attacker can call privileged trpc routes that lack proper cross-organization ownership checks, effectively bypassing authorization. Because it relies on existing roles and accepts arbitrary applicationId values, it can be exploited remotely over the network as long as the target exposes the tRPC API with authentication enabled.
