{"id":"CVE-2026-116068","kind":"vulnerability","aliases":["CVE-2026-116068"],"related":[],"title":"Dokploy: organization admins can control other tenants' applications","description":"Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.","summary":"Dokploy through 0.30.10 does not check that an application belongs to the caller's organization, so an owner or admin can pass a foreign applicationId. An attacker can then overwrite another tenant's environment variables and build secrets, repoint its sources, and deploy or stop its applications.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokploy","multi-tenant","package","self-hosted"],"not_affected_if":["managed-hosting","single-organization"],"how_to_check":"- Check the installed Dokploy version and see whether it is `0.30.10` or earlier.\n- Review audit logs or application configs for environment or source changes made by users outside the owning organization.","fix":"- Upgrade Dokploy to a release after `0.30.10`; the sources do not name the fixed version, so check the project's release notes.\n- Rotate environment variables and build secrets for applications in multi-tenant installs until the upgrade is confirmed.","status":"open","published_at":"2026-10-25T12:16:29+00:00","first_seen_at":"2026-10-25T12:40:44+00:00","triaged_at":"2026-10-25T12:41:24+00:00","updated_at":"2026-10-25T12:41:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T12:41:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Dokploy to a release after `0.30.10`; the sources do not name the fixed version, so check the project's release notes.\n- Rotate environment variables and build secrets for applications in multi-tenant installs until the upgrade is confirmed.","reach":"internet","title":"Dokploy: organization admins can control other tenants' applications","impact":"high","summary":"Dokploy through 0.30.10 does not check that an application belongs to the caller's organization, so an owner or admin can pass a foreign applicationId. An attacker can then overwrite another tenant's environment variables and build secrets, repoint its sources, and deploy or stop its applications.","category":"package","nicknames":[],"who_cares":["dokploy","self-hosted","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker overwrites other tenants' secrets and disrupts their deployed applications","analyst_note":"Confirm the fixed Dokploy version and whether multi-tenant deployments are the only practical exposure; the NVD entry gives no patch version.","how_to_check":"- Check the installed Dokploy version and see whether it is `0.30.10` or earlier.\n- Review audit logs or application configs for environment or source changes made by users outside the owning organization.","needs_analyst":true,"not_affected_if":["single-organization","managed-hosting"],"who_is_affected":"Self-hosted Dokploy installs that serve more than one organization are exposed, because the bypass lets one tenant's owner or admin act on another tenant's applications. Single-organization installs have no other tenants to reach, so the risk there is limited to insiders with admin rights.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3347,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116068':11A,14A '-2026':10A,13A '0.30.10':25B,72C 'admin':3A,42B,82C 'allow':79C 'anoth':53B 'applic':8A,31B,69B,90C,119C 'applicationid':47B,94C 'attack':49B,96C 'author':75C 'belong':32B 'build':59B,111C 'bypass':76C 'call':98C 'caller':35B 'check':28B 'contain':73C 'control':5A,87C 'cve':9A,12A 'deploy':65B,103C 'disrupt':116C 'dokploy':1A,15B,23B,70C 'environ':56B,108C 'foreign':46B,93C 'host':22B 'like':100C 'multi':17B 'multi-ten':16B 'organ':2A,37B,85C 'overwrit':52B,107C 'owner':40B,80C 'packag':19B 'pass':44B 'procedur':99C 'repoint':61B,113C 'saveenviron':101C 'secret':60B,112C 'self':21B 'self-host':20B 'sourc':63B,114C 'stop':67B,105C 'suppli':92C 'tenant':7A,18B,54B,89C,118C 'updatetraefikconfig':102C 'valu':95C 'variabl':57B,109C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Dokploy installs that serve more than one organization are exposed, because the bypass lets one tenant's owner or admin act on another tenant's applications. Single-organization installs have no other tenants to reach, so the risk there is limited to insiders with admin rights.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T12:16:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116068","severity":null,"published_at":"2026-10-25T12:16:29+00:00","modified_at":"2026-10-25T12:16:29+00:00","first_seen_at":"2026-10-25T12:40:44+00:00","fetched_at":"2026-10-25T12:40:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}