Dockyard’s admin interface exposes a GET endpoint that starts or stops containers without CSRF protection. An attacker can cause a logged‑in administrator’s browser to issue a request to /apps/action.php and trigger arbitrary container lifecycle changes. This allows the attacker to disrupt services by stopping critical containers or launch temporary containers that may run malicious code, thereby compromising availability and potentially confidentiality or integrity if the containers host privileged services.

The vulnerable component is Dockyard by 10ij. All releases prior to version 1.1.0 are affected; Dockyard 1.1.0 and later include the fix that protects the start/stop operations.

The CVSS score of 6.5 indicates moderate severity. The exploit probability is quantified by an EPSS score of 0.00107, which is well below 1% and indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be an authenticated user (the admin) whose browser can be prompted to send the malicious request, meaning an attacker needs either direct access to the admin user’s session or a social‑engineering technique to force the browser to send the request.