CVE-2026-72734
Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registration
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L |
| NVDNVD · Deferred | 3.1 | High8.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L |
- EPSS (exploitation in 30 days)
- 0.39% · top 67% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.
Weakness
Affected products
References (4)
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-3rpx-c3j9-q99x (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/Dokploy/dokploy/pull/4874 (opens in a new tab)x_refsource_MISC
- https://github.com/Dokploy/dokploy/commit/4aee66b2d1dc2c027749a541e553aa49947075c1 (opens in a new tab)x_refsource_MISC
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-72734)Record last updated .