Access Control Flaw in Dokploy PaaS Affects User Organization Scoping

CVE-2026-43917

What is CVE-2026-43917?

The vulnerability in Dokploy stems from inadequate enforcement of organization scoping within its protectedProcedure middleware. While it verifies user authentication, it fails to ensure that organizational data matches the logged-in user's active organization, leaving several endpoints exposed. This oversight affects critical operations such as managing deployments and backups, as endpoints like allByType, killProcess, and removeDeployment lack necessary restrictions based on the user’s organization. Proper validation must be integrated to prevent unauthorized access and ensure comprehensive security in the PaaS environment.

References