Dokploy before 0.29.13 exposes Git provider secrets (githubClientSecret, githubPrivateKey, githubWebhookSecret) through the application.one API endpoint. A user who has only service:read permission can retrieve another tenant’s secrets even when hasGitProviderAccess is false and unauthorizedProvider is set. The disclosed secrets could allow the attacker to impersonate the Git provider, gain unauthorized repository access, or trigger malicious webhooks, thereby undermining both confidentiality and the integrity of the application environment.

The vulnerability affects all Dokploy installations running a version older than 0.29.13. Any deployment that has not applied the v0.29.13 update is susceptible. The issue is specific to the Dokploy PaaS platform and does not affect other vendors or unrelated products.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet occurred. Attackers can exploit the flaw simply by issuing a request to the application.one endpoint, provided they hold a service:read role. No additional conditions are required, making the risk relatively high for any deployment that utilizes this least-privileged role.