CVE-2026-72734 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Dokploy versions 0.28.7 through 0.29.13 represents a critical access control flaw that enables unauthorized cross-organization server deletion through improper authorization checks. This weakness exists within the server.remove tRPC mutation endpoint located in apps/dokploy/server/api/routers/server.ts, where the system fails to validate that the requesting user's organization context aligns with the target server's organizational boundaries. The flaw stems from a lack of proper session validation and organization boundary enforcement during critical administrative operations.
The technical implementation of this vulnerability demonstrates a classic privilege escalation through insufficient authorization checks. When an authenticated user with server:delete permissions in one organization attempts to delete a server belonging to another organization, the system processes the request without verifying that currentServer.organizationId matches ctx.session.activeOrganizationId. This oversight allows attackers to leverage knowledge of valid server identifiers from other organizations to execute destructive operations against those systems. The mutation chain includes calls to haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer, all executed without cross-organization permission validation, creating a pathway for unauthorized deletion of critical infrastructure components.
The operational impact of this vulnerability extends beyond simple data deletion, as it enables attackers to disrupt service management operations while potentially gaining access to sensitive credentials. When an organization's server is deleted through this vulnerability, associated deployment records are removed from the system, interrupting continuous deployment workflows and service management capabilities. Additionally, the vulnerability allows unauthorized access to plaintext SSH private keys that are stored in association with the deleted server registration, creating a significant security risk for affected organizations. The fact that server.one mutation properly enforces cross-organization read restrictions while server.remove does not creates an asymmetric access control scenario that undermines the overall security posture.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a specific implementation of weak authorization checks within a multi-tenant application environment. The flaw demonstrates how seemingly isolated administrative operations can create cascading security issues when proper organizational boundary enforcement is missing from the system's permission model. From an ATT&CK perspective, this vulnerability maps to T1078 (Valid Accounts) and T1531 (Account Access Removal) as it allows attackers with legitimate credentials to escalate their privileges through unauthorized deletion of organization resources. The issue also relates to T1213 (Data from Information Repositories) since the system exposes sensitive credential information in a way that violates expected access control boundaries.
The fix implemented in version 0.29.13 addresses this vulnerability by enforcing proper organization context validation before executing server deletion operations. This remediation ensures that all administrative mutations verify the requesting user's session against the target resource's organizational boundaries, preventing cross-organization privilege escalation attacks. Organizations should immediately upgrade to version 0.29.13 or later to protect against this vulnerability, while also reviewing their existing server configurations and deployment records for any unauthorized deletions that may have occurred during the vulnerable timeframe. The fix reinforces proper separation of concerns in multi-tenant architectures and demonstrates the importance of implementing comprehensive authorization checks at all levels of application functionality.