CVE-2026-72883 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validate organization membership but do not enforce checkServiceAccess, accessedServerIds, or accessedServices, allowing an authenticated organization member to obtain root terminal access and read logs or statistics for restricted servers and services. This issue is fixed in version 0.29.13.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Dokploy platform as a service implementation where WebSocket handlers fail to properly enforce access controls despite validating organization membership. The flaw affects multiple terminal and monitoring endpoints including terminal.ts, docker-container-terminal.ts, docker-container-logs.ts, and docker-stats.ts which collectively provide operational access to containerized applications. These handlers validate that users belong to an organization but neglect to verify whether the authenticated member has proper service access permissions or has been granted access to specific server instances. The absence of checkServiceAccess validation creates a critical privilege escalation path where any authenticated organization member can potentially gain root terminal access to restricted servers and services that they should not have authorization to access.
The technical implementation of this vulnerability stems from improper access control enforcement within the WebSocket communication layer. When users establish WebSocket connections for terminal sessions, container logs retrieval, or system statistics monitoring, the system only verifies organizational affiliation without validating individual user permissions against specific service instances. This oversight allows attackers to exploit the authentication flow by leveraging their organization membership to access resources they should not be authorized to reach, effectively bypassing the intended multi-tenancy and access control mechanisms that separate different server environments and services within the platform.
The operational impact of this vulnerability is severe as it enables unauthorized access to sensitive operational data and system controls. An authenticated member could obtain root terminal access to servers they shouldn't be able to reach, potentially allowing them to execute arbitrary commands with elevated privileges on systems containing production applications or confidential data. Additionally, the ability to read logs or statistics for restricted services creates opportunities for information disclosure attacks where attackers can gather sensitive operational intelligence about systems they should not have access to. This vulnerability directly violates the principle of least privilege and can lead to complete compromise of the platform's security boundaries.
The fix implemented in version 0.29.13 addresses this by enforcing proper checkServiceAccess validation within the WebSocket handlers, ensuring that authenticated users must have explicit authorization to access specific server instances and services before being granted terminal, log, or statistics access. This mitigation aligns with established security practices for access control enforcement and follows the CWE-284 principle of inadequate access control. The solution should be evaluated against ATT&CK framework techniques related to privilege escalation and credential access where this vulnerability would map to T1078 (Valid Accounts) and T1566 (Phishing) as attackers could leverage compromised organization memberships to gain unauthorized access to restricted resources.
Organizations utilizing Dokploy should immediately upgrade to version 0.29.13 or later to remediate this vulnerability. System administrators should also implement monitoring for unusual WebSocket connection patterns that might indicate exploitation attempts, particularly around terminal access and log retrieval activities. The vulnerability demonstrates the critical importance of implementing proper access controls at all levels of application architecture including real-time communication channels such as WebSockets where traditional HTTP-based access controls may not be sufficient to prevent unauthorized access to sensitive operational resources.