The vulnerability occurs in the docker-container-terminal WebSocket endpoint of Dokploy, where the code authenticates but fails to verify the target container ID against the caller's role. An authenticated member can supply any container ID, resulting in a docker exec call with root privileges and obtaining a root shell in that container. This allows the attacker to read, modify, or delete data, run arbitrary commands, and potentially pivot to host‑level execution if container isolation is breached. The flaw corresponds to CWE‑862, an authorization bypass that can lead to full privilege escalation within containers.

Affected software is Dokploy Platform as a Service (PaaS) version 0.29.12 and earlier, including any self‑hosted deployments that have not yet applied the 0.29.13 release. The vulnerability resides in the /docker‑container‑terminal endpoint of the server component. Endpoints are typically accessed via WebSocket by authenticated users; any instance running these older versions is susceptible.

The CVSS score of 9.9 indicates critical severity. EPSS not available, so the likelihood of exploitation cannot be quantified but the flaw permits a privileged attacker to gain root access with only an authenticated session. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require that the attacker is a member of the application with valid credentials; from there, the unverified containerId can be supplied, leading to a root shell. Due to the high impact and lack of external defense in the code path, the overall risk is considered high.