CVE-2026-111331 Details
Description
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.
A cross-organization authorization bypass vulnerability has been identified in Dokploy versions through 0.30.8, specifically within the port tRPC router. This vulnerability allows authenticated owners or admins of any organization to manage ports belonging to other tenants, as the organization of the target application is not verified. Attackers can exploit this by providing a known portId or applicationId to the port.create, port.one, port.update, or port.delete procedures. This manipulation can disrupt how services are published for the affected tenants.
The vulnerability can be fixed by adding organization verification to the port router procedures, ensuring that only authorized users can access and modify port mappings for their own organization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/dokploy-port-router-cross-org-idor | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/Dokploy/dokploy | [email protected] | ProductSource CodeVendor |
| https://github.com/Dokploy/dokploy/blob/v0.30.8/apps/dokploy/server/api/routers/port.ts#L17-L113 | [email protected] | Source CodeVendor |
| https://github.com/Dokploy/dokploy/blob/v0.30.8/packages/server/src/services/permission.ts#L244-L261 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/dokploy-port-router-cross-org-idor | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/dokploy-through-0.30.8-cross-organization-authorization-bypass-via-port-trpc-router | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dokploy | <= 0.30.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |