Servers and applications
GHSA-29rq-cf85-cvc5
Ownerless volume backup exposes arbitrary Docker volumes without service access
- Severity
- High 7.1
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 0.31.1
- Weakness
- Missing authorization (CWE-862)
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Read data
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Sources
- Project advisories (GitHub)
Description
Volume-backup permission for assigned services should not permit exporting an arbitrary Docker volume that is not bound to an authorized service.
Dokploy's volume-backup schema makes every application and service ID optional. When all are omitted, both creation and manual execution skip checkServicePermissionAndAccess() entirely. The row still accepts an arbitrary volumeName, attacker destination, and appName.
The backup worker directly runs a temporary container with -v ${volumeName}:/volume_data, archives the mounted data, and uploads it using the selected destination. A base member therefore needs no service access to name a known volume and export its complete contents. Supplying an accessible service ID is an equivalent sibling because Dokploy never verifies that the volume belongs to that service.
Dokploy's volume-backup schema makes every application and service ID optional. When all are omitted, both creation and manual execution skip checkServicePermissionAndAccess()…
Affected software
| Software | Affected versions |
|---|---|
DokployServers and applications · github:dokploy/dokploy |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-29rq-cf85-cvc5
- github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-29rq-cf85-cvc5