Dokploy Cross-Organization Authorization Bypass in server.remove (BOLA) Analysis

Vulnerability Overview Title: Cross-organization authorization bypass in allows deletion of another organization's server registration Description: The RPC method accepts a parameter named and deletes the corresponding server record (along with related deployment rows), but does not verify whether the server belongs to the session's . When a user belongs to Organization A but their active organization is Organization B, they can delete a server registration belonging to Organization A. Adjacent procedures in the same router (such as , ) enforce organization ownership checks, but does not. Impact Scope Affected Versions: >= 0.28.7, <= 0.29.8 Fixed Version: None CVSS Score: 8.4/10 Impact: - Integrity: Cross-organization deletion of server registrations and their associated deployment records. - Availability: The victim organization can no longer manage the affected servers until re-registration. - Confidentiality: The deletion operation returns SSH key objects associated with the victim server in the form of plaintext PEM private keys. Remediation 1. Before , , and any deletion operations: 2. Run organization validation before service status checks to prevent cross-tenant existence/status leakage. 3. Consider returning a deletion response that omits . 4. Extract the ownership check to a shared helper function for reuse across all server-scoped procedures to prevent future endpoints from inadvertently ignoring it. For example: Proof of Concept (POC) Code Step 1 — Authentication Step 2 — Legitimately obtain Org-B's serverId (active organization is Org-B) Step 3 — Switch active organization to Org-A Step 4 — Control: Cross-organization read is denied Step 5 — Attack: Cross-organization deletion Confirmed Impact Integrity: Cross-organization deletion of server registrations and their associated deployment records. Availability: The victim organization can no longer manage the affected servers until re-registration. Confidentiality: The deletion operation returns SSH key objects associated with the victim server in the form of plaintext PEM private keys. Recovery Server registrations can be recreated by re-adding the server. Deleted deployment history and removed log directory contents are not recovered via re-registration. Root Cause 1. enforces role-based access control but does not bind the caller-provided to the . 2. Commit (2026-03-15) removed an existing explicit organization check. 3. is a service attachment guard, not a tenant boundary, and runs before any ownership verification. Relation to Existing Advisories GHSA-534x-qxwy-4cmm: router allows cross-organization reads via . Different router, procedure, permissions, action (read or destructive deletion), and confirmed impact. The remediation for this report does not fix , and vice versa. GHSA-h9wj-5c4w-8hpg / CVE-2026-43917: Lists other routers. Does not include . Regression Tests 1. User deletes a server from their own organization (no attached services) — Success. 2. User uses providing Org-B's in Org-A — . 3. Member role without permission — . 4. Non-existent — Secure error, no cross-tenant existence leakage. 5. Org-B server has attached services, called from a cross-organization actor — Ownership check rejects before the branch. 6. Deletion response does not expose cross-organization SSH private key material. Disclosure Notes All tests were conducted locally against a disposable multi-tenant lab environment. No third-party or production Dokploy systems were accessed. SSH private keys were verified for format and availability, but key material is not included in this report (displayed as ). Impact is limited to Dokploy-managed database records and credentials returned in API responses; no remote host compromise or code execution is claimed.

Goal Reached Thanks to every supporter — we hit 100%!

Dokploy Cross-Organization Authorization Bypass in server.remove (BOLA) Analysis

More from this source