Authorization Bypass in Dokploy Affects Multi-Tenant Application Management

CVE-2026-116068

What is CVE-2026-116068?

Dokploy versions up to 0.30.10 are prone to an authorization bypass vulnerability, allowing users with administrative privileges to manipulate applications belonging to other organizations. By exploiting this flaw, an attacker can send manipulated applicationId values to perform unauthorized actions such as overwriting environment variables, adjusting build secrets, and altering source configurations. This poses a significant risk to the stability and security of shared applications in a multi-tenant environment, as malicious users can disrupt critical deployments and configurations of other tenants.

References