UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53374

User Information Disclosure via user.one Endpoint

Severity
Low 1.3
Published
5 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
0.23.6, 0.23.7
Also known as
GHSA-fcq8-wv2q-f758
Sources
NVD, Project advisories (GitHub)

Description

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The response discloses personally-identifiable information (PII) such as e-mail address, role, two-factor…

Affected software

SoftwareAffected versions
DokployServers and applications · cpe:a:dokploy:dokploy
  • Every version before 0.23.7
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.23.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53374
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53374
  • GitHub Advisory Database https://github.com/advisories/GHSA-fcq8-wv2q-f758
  • github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-fcq8-wv2q-f758