Dokploy Authorization Bypass via Port tRPC Router

Executive Summary

Dokploy through version 0.30.8 has a cross-organization authorization bypass in the port tRPC router. Authenticated owners or admins of any organization can manage other tenants' ports without verifying the target application's organization. This allows attackers with a known portId or applicationId to use functions like port.create, port.one, port.update, or port.delete to read, modify, delete, or add port mappings, disrupting how victim services are published.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to manipulate port mappings, potentially exposing or disrupting services. Attackers could redirect traffic, intercept data, or cause service outages by adding, modifying, or deleting ports. If you use Dokploy for service management, your published services could be compromised or misconfigured without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Unauthorized port modifications may expose sensitive data or disrupt critical services, resulting in non-compliance with these regulations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dokploy to a version later than 0.30.8 where the authorization bypass issue is fixed. Review and restrict access controls for port management functions to ensure only authorized users can modify ports.

Useful 0 Not Useful 0