Dokploy's free, self-hostable PaaS web interface up to version 0.26.5 lacked X‑Frame‑Options and CSP frame‑ancestors headers. This allows attackers to embed legitimate Dokploy pages inside malicious iframes and trick authenticated users into executing unintended actions. The flaw is classified as CWE‑1021 and can lead to credential compromise or accidental submission of sensitive forms, but it does not grant direct access to system files or result in code execution.

Affected systems are deployment instances of the Dokploy PaaS product, vendor Dokploy. The vulnerability exists in all released versions before 0.26.6, including 0.25.x and 0.26.x releases. Any user running those earlier versions must update to the patched version.

The CVSS score of 4.7 indicates moderate severity. The EPSS score of less than 1 % reflects a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit it over HTTPS by embedding the target site in an iframe, requiring the victim to be authenticated. While the impact is limited to actions performed in the spoofed context, repeated or coordinated attacks could lead to credential theft or data disclosure.