Dokploy versions 0.29.8 and earlier contain an IDOR flaw in the backup creation, update and restoration APIs. The endpoint accepts a client‑supplied destinationId but does not verify that the referenced destination belongs to the same organization as the authenticated user. This flaw is catalogued as CWE-639 and leads to a privilege escalation that allows an attacker to retrieve or manipulate another organization’s S3 access key and secret, exposing backups or redirecting them. The vulnerability can result in loss of confidentiality and integrity of tenant data and could be leveraged for further compromise of the backup target.

The affected product is the Dokploy Platform as a Service, specifically all installations running version 0.29.8 or earlier. Users deploying newer releases are not impacted. The vulnerability is triggered when an authenticated member has backup permissions on a service and can target any backup destination belonging to a different organization.

The CVSS score of 9.6 denotes Critical severity. No EPSS score is currently available, but the issue’s nature as a cross‑tenant data breach means it could be targeted by malicious actors. The vulnerability is not listed in the CISA KEV catalog, yet the impact and the possibility for an attacker with backup roles to gain S3 credentials increase the risk profile. The attack vector is likely application‑level: an authenticated user performs a backup operation in one organization and supplies a destinationId from another organization to obtain that organization’s credentials through the getS3Credentials helper. The attacker’s prerequisites are simply possessing backup permissions for a service, a common role in many deployments.