Dokploy: Cross-Organization Authorization Bypass and Tenant Application Takeover

In Dokploy versions up to and including 0.30.10 a high severity vulnerability CVE-2026-116068 was detected. This vulnerability allows an authenticated attacker, specifically an owner or admin of one organization, to bypass authorization controls and manipulate applications belonging to other tenants. This occurs within the Application tRPC Router, which fails to properly validate the ownership of the supplied applicationId. By providing a foreign applicationId, an attacker can invoke sensitive procedures such as saveEnvironment, updateTraefikConfig, deploy, or stop. This leads to unauthorized actions including the overwriting of environment variables and build secrets, repointing of application sources, and complete disruption of other tenants’ applications. To address this issue, users should apply the specific remediation patch committed in the source code (commit b3cd3c5). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-116068.