The vulnerability allows Dokploy users who normally lack access to a Git provider to retrieve plaintext provider credentials via the github.one, gitlab.one, gitea.one, and bitbucket.one endpoints, as well as nested GitHub, GitLab, Gitea, and Bitbucket credentials through the application.one route. The exposed data includes private keys, OAuth tokens, client secrets, webhook secrets, and app passwords, enabling an attacker to read private repositories or manipulate external workflows. The weakness is classified as CWE‑200 (Information Exposure) and CWE‑862 (Missing Authorization).

Dokploy, the self‑hosted Platform as a Service, is affected in all releases prior to 0.29.13. Users of older versions that interact with the .one endpoints or the application.one route are able to exploit the flaw regardless of their assigned Git provider permissions.

The CVSS score of 9.6 classifies this issue as Critical, and the lack of a publicly available EPSS score does not diminish the high likelihood that the flaw will be leveraged by malicious actors. The vulnerability is not currently listed in CISA KEV, but its severity and the fact that exposed credentials can be used to access private resources make it a high‑risk exploit that can be performed over standard network connections to the Dokploy instance. The likely attack vector is a direct HTTP request to the vulnerable endpoints by any member with at least application read access, allowing bypass of per‑member provider assignment.