CVE-2026-72734
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Dokploy from version 0.28.7 to 0.29.13 has a vulnerability in the server.remove tRPC mutation, which does not verify that the server's organization ID matches the session's active organization. An authenticated owner or administrator with server:delete in one organization can delete another organization's server and deployment records and receive the associated plaintext SSH private key.
Risk Assessment
An attacker can disrupt Dokploy management by deleting servers of other organizations and obtaining confidential SSH keys, potentially leading to unauthorized infrastructure access.
Recommendation
Update Dokploy to version 0.29.13 or later, which fixes this issue.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.