CVE-2026-45790 in Dokploy
Summary
by MITRE • 08/17/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Dokploy versions prior to 0.29.6 represents a critical privilege escalation flaw rooted in insufficient access control mechanisms within the platform's core administrative functions. As a self-hostable Platform as a Service, Dokploy relies on strict role-based access controls to maintain organizational integrity and security boundaries between different user tiers. The specific weakness lies in two distinct code paths that fail to properly validate or restrict the assignment of high-privilege roles during account creation and member invitation processes. This architectural oversight allows authenticated users with seemingly standard permissions to bypass intended restrictions and assume control over entire organizations, leading to a complete compromise of the hosting environment's administrative security posture.
The first vector for exploitation involves the organization.inviteMember tRPC procedure located in apps/dokploy/server/api/routers/organization.ts. Under normal operational parameters, this endpoint is designed to allow users with member:create permissions to invite new individuals into an organization as standard members or contributors. However, due to a lack of rigorous input validation and role assignment checks, the function permits these users to specify arbitrary roles during the invitation process. Specifically, it allows the inviting user to assign the owner role to the invited account. Since Dokploy does not provide a mechanism to demote existing owners once they are assigned this highest level of privilege, any entity gaining ownership status retains permanent administrative control over the organization and its associated resources, regardless of subsequent attempts by other administrators to revoke or modify those permissions.
The second vector is found in packages/server/src/services/user.ts, which handles user account creation for self-hosted instances. This service module contains a logic flaw that allows privileged users to create new accounts with arbitrary roles assigned at the time of initialization. By manipulating this endpoint, an attacker can directly instantiate a new administrative or owner-level account without requiring any invitation workflow. This bypasses standard onboarding procedures and audit trails associated with member invitations. The combination of these two vulnerabilities creates a robust attack path where an adversary can either invite themselves as an owner through the organization router or create a standalone privileged account, both resulting in unauthorized elevation to the highest level of system authority available within Dokploy.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations relying on Dokploy for their deployment infrastructure. An attacker who successfully exploits these flaws gains full administrative control over the platform instance. This includes the ability to modify application configurations, access sensitive environment variables and secrets stored in the database, deploy malicious code or backdoors into running containers, and exfiltrate data from hosted applications. Because owner roles cannot be demoted, the compromise is persistent; even if the initial attacker's account is discovered and deleted, any secondary accounts created via these vulnerabilities remain active unless manually purged by other administrators who may not have detected the breach immediately. This effectively results in a permanent takeover of the organization's digital assets and infrastructure integrity.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it involves the failure to enforce proper role-based access controls during user assignment operations. It also maps closely to ATT&CK technique T1078, Valid Accounts, specifically the sub-category of Local Accounts or Cloud Accounts being used for unauthorized privilege escalation and persistence within a trusted environment. The flaw exemplifies how inadequate validation of administrative inputs can lead to complete system compromise in multi-tenant platforms that rely on hierarchical role structures.
Mitigation strategies must focus on immediate remediation through software updates and subsequent hardening of access control policies. Organizations running Dokploy prior to version 0.29.6 should upgrade to the patched release immediately, as this update resolves the validation logic errors in both the organization invitation router and the user service creation module. Following the upgrade, administrators must audit existing organizations for any unauthorized owner accounts that may have been created during a potential window of exploitation. This involves reviewing membership lists and removing any suspicious or unknown high-privilege users. Additionally, implementing strict input sanitization on all administrative endpoints to ensure role assignments are restricted to predefined, safe values is essential. Regular security audits focusing on privilege escalation vectors in self-hosted PaaS solutions will help prevent similar issues from arising in future development cycles.