CVE-2026-72737

Received Received - Intake

Privilege Escalation in Dokploy Backup Management

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's service host, read that organization's backup objects, or redirect and poison backups across tenant boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72737

EUVD

EUVD-2026-55685

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	to 0.29.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Dokploy versions 0.29.8 and earlier allows authenticated users with backup permissions in one organization to access or manipulate backups belonging to another organization. The issue occurs because the backup functions do not verify that the destination organization matches the user's active organization, enabling cross-tenant data access.

Detection Guidance

This vulnerability requires checking for unauthorized access to backup destinations across organizations. Inspect logs for backup operations in Dokploy (0.29.8 or earlier) where destinationId is manipulated. Look for mismatches between destination.organizationId and ctx.session.activeOrganizationId in backup.create, backup.update, or backup.restoreBackupWithLogs endpoints.

Impact Analysis

An attacker could read sensitive backup data from other organizations, redirect backups to malicious locations, or poison backups by overwriting them with malicious content. This could lead to data breaches, unauthorized access to confidential information, or disruption of backup integrity.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR's data protection principles or HIPAA's access controls, as it enables unauthorized cross-organizational data access. Organizations using affected versions may face regulatory penalties or loss of compliance certifications.

Mitigation Strategies

Upgrade Dokploy to a version later than 0.29.8 where the backup API endpoints validate organizationId against the active session. Review backup destinations for unauthorized access and revoke any exposed S3 credentials.

Hi! I’m here to help you understand CVE-2026-72737. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70