Servers and applications
GHSA-3qp9-jw8g-424v
Cross-organization Docker network control through unchecked `serverId`
- Severity
- Medium 6.0
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 0.31.1
- Weakness
- Missing authorization (CWE-862)
- Attack
- Over the network · Only under certain conditions · Needs a user account · No user action needed
- Attacker can
- Read some data · Change some data · Slow it down
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L- Sources
- Project advisories (GitHub)
Description
A logged in member can make Dokploy run Docker network actions on a server owned by another organization.
The network routes accept a serverId from the request, but do not check that the server belongs to the active organization. A member who knows a foreign serverId can list networks, create a network, import a network, inspect it, and remove an unused network.
Severity is medium when the foreign server id must be guessed, and high when server ids are exposed.
In apps/dokploy/server/api/routers/network.ts, the network routes accept a caller supplied serverId and use only protectedProcedure:
In packages/server/src/services/network.ts, that server id is used for the Docker connection:
getRemoteDocker looks up the server by id only. It does not check that the server belongs to the active organization. The same missing check affects network listing and import.
This is an authorization bug.
Affected software
| Software | Affected versions |
|---|---|
DokployServers and applications · github:dokploy/dokploy |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-3qp9-jw8g-424v
- github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-3qp9-jw8g-424v