Dokploy up to 0.30.8 Port TRPC Router port.create/port.one/port.update/port.delete portId/applicationId authorization

Summaryinfo

A vulnerability was found in Dokploy up to 0.30.8. It has been declared as problematic. This affects the function port.create/port.one/port.update/port.delete of the component Port TRPC Router. The manipulation of the argument portId/applicationId results in authorization. This vulnerability is reported as CVE-2026-111331. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Dokploy up to 0.30.8. It has been classified as problematic. Affected is the function port.create/port.one/port.update/port.delete of the component Port TRPC Router. The manipulation of the argument portId/applicationId with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.

The advisory is shared for download at hackmd.io. This vulnerability is traded as CVE-2026-111331 since 10/15/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Dokploy

Version

• 0.30.0
• 0.30.1
• 0.30.2
• 0.30.3
• 0.30.4
• 0.30.5
• 0.30.6
• 0.30.7
• 0.30.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion