Dokploy’s inviteMember API allowed a member-level user with the member:create permission to invite a new account with the owner role. This privileged self-hosted functionality also enabled any user with the ability to create accounts to assign an arbitrary role. The combination of these misconfigurations enabled an attacker to inject an account that holds owner privileges and cannot be demoted, resulting in an absolute takeover of the organization and all its resources. The affected weakness is a role-based access control flaw.

The vulnerability applies to Dokploy versions prior to 0.29.6. All deployments of Dokploy that have not applied the v0.29.6 release are affected. The problem is inherent to the organization.inviteMember procedure in the server API and the account creation logic in the user services module.

The CVSS score of 8 classifies the issue as high severity. EPSS information is not available, so the current public exploitation probability cannot be quantified, but because the vulnerability directly allows a member to elevate privileges and acquire owner rights, the attack can be performed with no further prerequisites beyond legitimate membership and API access. The vulnerability is not listed in CISA’s KEV catalog, which suggests no public exploit evidence yet, yet the impact of a successful exploit would be catastrophic for all affected organizations. The likely attack vector is through the documented API endpoint, which may be accessed by an authenticated member with the member:create permission.