Dokploy PaaS contains an IDOR vulnerability in the protectedProcedure middleware. In versions 0.19.0 and older the middleware only verifies that a user is authenticated but does not enforce that the requested resource belongs to the user’s active organization. Each tRPC endpoint listed in the advisory, such as deployment, backup, volume‑backups, cluster, and mount, must perform their own organization validation, but they currently do not. The result is that an authenticated user can access, modify, or delete resources controlled by other organizations. The flaw directly maps to CWE‑639, Improper Authorization.

The vulnerability affects the Dokploy platform as a service, specifically releases 0.19.0 and earlier. Attackers with access to any of the exposed tRPC endpoints can read or modify deployments, backups, cluster nodes, and mount points for organizations other than the one they belong to. The problem is present in the following modules: deployment, rollbacks, backup, volume‑backups, cluster, and mount.

The CVSS v3 base score is 5.3, indicating moderate complexity and a moderate potential damage scope. No EPSS score is provided, but the lack of a KEV listing suggests that large‑scale exploitation is not yet documented. The attack requires a valid authenticated session; an attacker who has control of a user account with permission to use any tRPC endpoint can craft requests to endpoints that only check authentication and then target resources in other organizations. Because many endpoints need to individually check organization scoping, the vulnerability can be abused by typical authenticated users or by attackers who have stolen credentials.