Dokploy’s WebSocket terminal endpoint allows an authenticated user to connect to /terminal?serverId=local and retrieve an interactive shell on the host. The endpoint validates a session but fails to authorize the specific server requested, letting the user bypass organization role checks. This flaw grants the attacker privileged access to the underlying operating system without additional permissions, enabling potential compromise of data and further attacks from the host. The flaw is a classic authorization bypass and falls under CWE-862.

The vulnerability affects Dokploy installations running any version prior to 0.29.13. All users of the free, self‑hostable Platform as a Service platform named Dokploy that authenticate to the WebSocket terminal are at risk unless updated to the fixed release.

The CVSS score of 8.8 indicates a high severity, and while EPSS information is not available, the flaw is not listed in the CISA KEV catalog. An attacker must first be authenticated to Dokploy, but once logged in, can exploit the endpoint by specifying the special serverId=local parameter to gain shell access. Because the bug allows arbitrary host interaction, the risk to confidentiality, integrity, and availability is significant.