CVE-2026-72737 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's service host, read that organization's backup objects, or redirect and poison backups across tenant boundaries.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authorization bypass flaw in Dokploy's backup functionality that enables cross-tenant data access and manipulation. The issue exists in versions 0.29.8 and earlier where the backup.create, backup.update, and backup.restoreBackupWithLogs API endpoints fail to properly validate that the destinationId parameter references a backup destination belonging to the authenticated user's active organization. This oversight creates a severe privilege escalation vector that allows malicious actors to access sensitive backup credentials and data from other organizations within the same instance.
The technical implementation flaw stems from the lack of proper organization boundary validation in the backup management API routes. When an attacker provides a destinationId parameter, the system retrieves the backup destination configuration without verifying that the destination belongs to the requesting user's organization. This validation gap specifically affects the getS3Credentials function in packages/server/src/utils/backups/utils.ts which materializes S3 accessKey and secretAccessKey credentials on the attacker's service host. The vulnerability operates at the application layer and leverages the principle of least privilege violation, where authenticated users can access resources beyond their intended scope.
The operational impact of this vulnerability is substantial and multi-faceted across multiple security domains. An authenticated member with backup permissions in one organization can potentially exfiltrate backup data from other organizations by reading their S3 backup objects directly. Additionally, the attacker can manipulate backup operations to redirect backups to malicious destinations, effectively poisoning backup chains and compromising data integrity across tenant boundaries. This cross-tenant access capability also enables potential data leakage scenarios where sensitive backup information from one organization becomes accessible to unauthorized parties in another organization.
This vulnerability maps directly to CWE-284 (Improper Access Control) and aligns with several ATT&CK techniques including T1078 (Valid Accounts), T1566 (Phishing), and T1531 (Account Access Removal). The flaw represents a classic case of insufficient input validation combined with inadequate access control enforcement, creating a path for unauthorized data access that violates fundamental security principles. Organizations using affected versions face significant risk of data breaches, compliance violations, and potential regulatory penalties due to the unauthorized cross-tenant access capabilities.
The recommended mitigations include implementing strict organization boundary checks in all backup-related API endpoints before processing destinationId parameters. The system must verify that destination.organizationId equals ctx.session.activeOrganizationId for each backup operation, ensuring proper tenant isolation. Additionally, organizations should implement comprehensive audit logging of backup operations and destination changes to detect unauthorized access attempts. Security teams should also consider implementing rate limiting and monitoring for suspicious backup activity patterns across different organizations within the same instance. The fix should involve updating the backup management routines to enforce organization-level authorization checks before any credential materialization or data access occurs, effectively closing the cross-tenant boundary violation that enables this exploitation path.