CVE-2026-111331 in Dokploy
Summary
by MITRE • 10/16/2026
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Dokploy versions through 0.30.8 represents a critical failure in access control mechanisms within the application's tRPC router infrastructure. Specifically, this is an insecure direct object reference (IDOR) flaw that manifests as a cross-organization authorization bypass. The core technical deficiency lies in the server-side logic handling port management operations, where the system fails to validate whether the target resource belongs to the organization associated with the authenticated user session. While authentication successfully verifies the identity of the requester and confirms their role as an owner or administrator within their own tenant context, the subsequent authorization step neglects to enforce boundary checks against the specific application or port being accessed. This architectural oversight allows any authenticated principal to interact with resources outside their designated organizational scope simply by manipulating input parameters.
From a technical perspective, the vulnerability exploits the trust placed in client-supplied identifiers such as portId and applicationId during API calls for creating, retrieving, updating, or deleting port mappings. The tRPC endpoints responsible for these operations do not perform a secondary lookup to ensure that the requested resource is linked to an organization where the user holds valid privileges. Consequently, if an attacker can enumerate or guess valid identifiers belonging to other tenants within the multi-tenant environment, they can execute administrative actions on those external resources without triggering any access denial errors. This lack of server-side validation effectively neutralizes the isolation guarantees intended by the platform's multi-tenancy architecture, turning role-based permissions into a superficial barrier that does not extend to resource-level security checks.
The operational impact of this vulnerability is severe for organizations relying on Dokploy for service deployment and management. An attacker with access to any organization can disrupt the availability and integrity of services hosted by other tenants. By modifying or deleting port mappings, an adversary can cause denial-of-service conditions where legitimate users are unable to reach critical applications due to broken network configurations. Furthermore, the ability to create new port mappings allows for unauthorized exposure of internal services or interception of traffic if malicious routing rules are established. This compromises not only the confidentiality and integrity of data processed by these services but also undermines trust in the platform's security model, potentially leading to broader systemic risks such as lateral movement within a compromised network environment where inter-tenant isolation is assumed to be intact.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying user authorization for specific objects or resources. It also maps directly to the MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate credentials but abuses them through insufficient privilege separation between organizational boundaries. To mitigate this risk, immediate patching to a version of Dokploy later than 0.30.8 is required, where developers have implemented strict ownership verification logic in the tRPC handlers. In the interim, administrators should enforce network-level segmentation and monitor API logs for anomalous patterns involving cross-tenant resource access attempts. Additionally, implementing robust input validation that verifies organizational context against every requested resource ID before processing any mutation or read operation is essential to restoring proper security boundaries within the multi-tenant architecture.