CVE-2026-43917: Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.19.0 and earlier, the protectedProcedure middleware only verifies the user is authenticated - it does NOT enforce organization scoping. Each endpoint must individually verify the resource's org matches the session's activeOrganizationId. This affects the following endpoints: allByType, killProcess, and removeDeployment in deployment.ts; delete in rollbacks.ts; create, one, update, remove, manualBackupPostgres, MySql, Mariadb, Mongo, Compose, WebServer, and listBackupFiles in backup.ts; list, one, delete, update, runManually, and restoreVolumeBackupWithLogs in volume-backups.ts; getNodes, removeWorker, addWorker, and addManager in cluster.ts; and create in mount.ts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.19.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43917?
The severity of CVE-2026-43917 is rated as medium with a CVSS score of 5.3.
What kind of vulnerability is CVE-2026-43917?
CVE-2026-43917 is a Cross-Organization IDOR vulnerability due to multiple tRPC endpoints lacking activeOrganizationId validation.
How do I fix CVE-2026-43917?
To fix CVE-2026-43917, ensure that each endpoint verifies that the resource's organization matches the session's activeOrganizationId.
In which version of Dokploy is CVE-2026-43917 present?
CVE-2026-43917 is present in Dokploy versions 0.19.0 and earlier.
What type of applications are affected by CVE-2026-43917?
CVE-2026-43917 affects users of Dokploy, which is a self-hostable Platform as a Service (PaaS).