CVE-2026-72734

Received Received - Intake

Privilege Escalation in Dokploy via Server Deletion

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72734

EUVD

EUVD-2026-55680

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Dokploy (versions 0.28.7 to 0.29.12) allows authenticated users with server:delete permissions in one organization to delete servers and deployment records from another organization by exploiting a flawed server removal function. The issue occurs because the server.remove mutation does not verify if the target server belongs to the user's organization before performing deletion actions.

Detection Guidance

This vulnerability involves unauthorized deletion of servers across organizations due to improper authorization checks in Dokploy versions 0.28.7 to 0.29.12. To detect it, check Dokploy server logs for unusual server deletion events or mismatched organization IDs. Review server IDs accessed by users with server:delete permissions. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow unauthorized deletion of servers and their associated deployment records across organizations. Attackers could disrupt services, gain access to plaintext SSH private keys of deleted servers, and cause operational downtime for affected organizations.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's data integrity and availability requirements or HIPAA's integrity and availability standards. Organizations using affected versions may face compliance violations if servers containing regulated data are improperly deleted.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately to patch the vulnerability. Review user permissions for server:delete and ensure proper organization ID verification. Monitor for unauthorized server deletions or SSH key exposure. Revoke access for any suspicious accounts.

Hi! I’m here to help you understand CVE-2026-72734. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70