CVE-2026-111331: Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is an owner or admin of any Dokploy organization can exploit it. The attacker does not need membership in the victim organization.
What information does an attacker need?
The attacker needs a known target portId or applicationId. Those identifiers can be supplied to the affected port.create, port.one, port.update, or port.delete operations.
Which actions can be performed against another organization?
An attacker can read, modify, delete, or add port mappings for another tenant's applications. This can disrupt how the victim's services are published.
Are ordinary authenticated users affected by this authorization gap?
The described exploit requires owner or admin privileges in an organization. The available information does not state that lower-privileged authenticated users can exploit it.