CVE-2026-116068

Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

Published: 2026-10-25
Last modified: 2026-10-25
CNA: VulnCheck
NVD status: Deferred
CWE: CWE-639

CVSS v3.1 (listed by NVD)

8.8

HIGH

Scored by vulncheck.com (not yet scored by NVD)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0 (listed by NVD)

8.7

HIGH

Scored by vulncheck.com (not yet scored by NVD)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS (listed by CVE.org)

8.7

HIGH

Scored by CNA (VulnCheck) · v4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS exploit probability

—

Not computed

CISA KEV

—

Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 3.1 vector

NetworkLoginNo interaction Confidentiality HIntegrity HAvailability H

Metric	Value	Meaning
Attack vector AV	N	Network
Attack complexity AC	L	Low (easy)
Privileges required PR	L	Regular user
User interaction UI	N	None
Scope S	U	Unchanged
Confidentiality C	H	High
Integrity I	H	High
Availability A	H	High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

NVD

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

CVSS assessments

Provider	Version	Score	Vector
NVD / [email protected] (Secondary)	4.0	8.7 HIGH	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
NVD / [email protected] (Primary)	3.1	8.8 HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CNA / VulnCheck	4.0	8.7 HIGH	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
CNA / VulnCheck	3.1	8.8 HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products and packages

CNA (CVE.org)

Vendor	Product	Versions
Dokploy	dokploy	affected: 0 … <= 0.30.10 default: unaffected

Linux distribution status

Red Hat ↗

No record

Debian ↗

No record

Ubuntu ↗

No record

References (6)

https://github.com/Dokploy/dokploy NVD, CNA product
https://github.com/Dokploy/dokploy/blob/073713f0b863eca4285ad24db00550af1b39397a/apps/dokploy/server/api/routers/application.ts#L490-L501 NVD, CNA technical-description
https://github.com/Dokploy/dokploy/blob/073713f0b863eca4285ad24db00550af1b39397a/packages/server/src/services/permission.ts#L244-L261 NVD, CNA technical-description
https://github.com/Dokploy/dokploy/commit/b3cd3c5061b9e4f9a786dc4a048765f79bae2523 NVD, CNA patch
https://github.com/Dokploy/dokploy/issues/5635 NVD, CNA issue-tracking
https://www.vulncheck.com/advisories/dokploy-through-0.30.10-cross-organization-authorization-bypass-via-application-trpc-router NVD, CNA third-party-advisory