Dokploy’s WebSocket handlers for terminal, Docker container logs, and statistics validate only organization membership but omit essential service‑level checks. This allows any authenticated member of an organization to open a WebSocket terminal with root privileges, read logs, and view statistics for servers and services they should not access. The weakness is a missing privilege enforcement (CWE-862) and leads to privilege escalation that can be leveraged for remote code execution.

Affected installations of Dokploy prior to version 0.29.13 contain the flaw in the server files wss/terminal.ts, wss/docker-container-terminal.ts, wss/docker-container-logs.ts, and wss/docker-stats.ts. All authenticated users of those releases could exploit the weakness.

The vulnerability carries a CVSS score of 8.8, marking it as high severity. EPSS information is not available and it is not listed in the CISA KEV catalog. An attacker who authenticates to the platform can immediately gain root shell access and read privileged data across the organization, fulfilling the full impact of the flaw. The attack vector is via authenticated WebSocket connections, so mitigation requires proper service‑level controls or upgrading.