Cross-Organization Authorization Bypass in Dokploy Product by Dokploy

CVE-2026-111331

What is CVE-2026-111331?

The Dokploy application versions up to 0.30.8 are susceptible to a cross-organization authorization bypass in the tRPC router. This flaw enables authenticated users with owner or admin privileges to manipulate port mappings of other organization's tenants without proper verification. By exploiting this vulnerability, an attacker can perform actions such as reading, modifying, deleting, or adding ports by supplying a known portId or applicationId. This disruption could lead to unauthorized access to critical services and compromise the integrity of the affected applications.

References