CVE-2026-116068
Deferred Deferred - Pending Action

Authorization Bypass in Dokploy Allows Tenant Application Takeover

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116068
EUVD
EUVD-2026-109382

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Dokploy dokploy 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dokploy through 0.30.10 has an authorization bypass flaw where owners or admins of any organization can control applications belonging to other tenants by supplying foreign application IDs. This allows them to call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables, build secrets, repoint sources, and disrupt other tenants' applications.

Detection Guidance

To detect this vulnerability, review application logs for unauthorized access attempts or modifications to environment variables and secrets. Check for cross-organization resource access in the Dokploy API logs, particularly for procedures like saveEnvironment, updateTraefikConfig, deploy, or stop. Monitor for unexpected changes in application configurations or deployments.

Impact Analysis

Attackers with admin or owner privileges in one organization could manipulate applications in other organizations, leading to unauthorized data access, service disruption, or complete control over affected applications. This could result in data breaches, application downtime, or loss of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information security). Organizations using Dokploy may face legal penalties, data breach notifications, and reputational damage due to non-compliance.

Mitigation Strategies

Immediately update Dokploy to the latest version that includes the security fixes. Review and restrict user permissions, ensuring owners and admins cannot access resources outside their organization. Audit all applications for unauthorized changes and revoke any suspicious access tokens or credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116068. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart