---
id: "CVE-2026-116068"
kind: "vulnerability"
aliases: ["CVE-2026-116068"]
title: "Dokploy: organization admins can control other tenants' applications"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dokploy", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "single-organization"]
published_at: "2026-10-25T12:16:29+00:00"
first_seen_at: "2026-10-25T12:40:44+00:00"
updated_at: "2026-10-25T12:41:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116068", "first_seen_at": "2026-10-25T12:40:44+00:00"}]
---

# Dokploy: organization admins can control other tenants' applications

Dokploy through 0.30.10 does not check that an application belongs to the caller's organization, so an owner or admin can pass a foreign applicationId. An attacker can then overwrite another tenant's environment variables and build secrets, repoint its sources, and deploy or stop its applications.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dokploy version and see whether it is `0.30.10` or earlier.
- Review audit logs or application configs for environment or source changes made by users outside the owning organization.

## Fix

- Upgrade Dokploy to a release after `0.30.10`; the sources do not name the fixed version, so check the project's release notes.
- Rotate environment variables and build secrets for applications in multi-tenant installs until the upgrade is confirmed.

## Timeline

- 2026-10-25T12:40:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116068

## From the sources

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_