Dokploy: Authorization bypass allows cross-organization control of applications

Summary

Dokploy through 0.30.10 does not verify that an application belongs to the caller's organization. An owner or admin of any organization with a valid account can supply foreign applicationId values to procedures such as saveEnvironment, updateTraefikConfig, deploy and stop. This allows an attacker to overwrite environment variables and build secrets, repoint sources, and disrupt applications of other tenants.

Affected

• Dokploy through 0.30.10
• Default configuration as stated by the CNA: versions above 0.30.10 are not affected

Fixed in

• Unknown. Third-party records indicate version 0.30.11 or later, but this is not confirmed by Dokploy's release notes or the fix commit.

Workaround

• No official workaround documented.
• Partial mitigation: network isolation between tenants and firewall rules that limit access to the internal API endpoints.
• Until the update: limit owner and admin roles to the minimum and restrict access to the Dokploy web panel.

Exploitation

• No evidence of exploitation in the wild found. The CVE is not listed in CISA KEV.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• A public exploit entry exists, but its content could not be verified.

Our recommendation

• Inventory all Dokploy instances and their versions.
• Update to the latest Dokploy release and verify the fix against the vendor commit.
• Review organization memberships and owner and admin accounts.
• Restrict the Dokploy admin interface (VPN or allow-list) if it is internet-facing.
• Review audit logs for unexpected deploys, stops or environment-variable changes on multi-tenant instances.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-116068 VulnCheck advisory www.vulncheck.com
• Dokploy fix commit b3cd3c5 github.com
• Dokploy GitHub repository github.com
• Dokploy issue 5635 github.com
• Affected router code (application.ts) github.com
• Permission service code (permission.ts) github.com
• VulDB CVE-2026-116068 vuldb.com
• Strix CVE-2026-116068 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:20.