Dokploy: Cross-Organization Authorization Bypass in port tRPC Router

In Dokploy versions up to and including 0.30.8 a medium severity vulnerability CVE-2026-111331 was detected. This vulnerability allows authenticated users with owner or admin roles in one organization to bypass authorization and manage ports belonging to other tenants. This occurs due to a cross-organization authorization bypass flaw within the port tRPC router. Because the target application’s organization is not explicitly verified, an attacker can supply a known portId or applicationId to endpoints such as port.create, port.one, port.update, or port.delete. This enables them to read, modify, delete, or add port mappings for unrelated organizations, effectively disrupting how victim services are published or maliciously routing traffic. To address this issue, users should upgrade Dokploy to a patched version 0.30.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-111331.