UpHeron
All vulnerabilities

Servers and applications

GHSA-6g88-x4hx-9837

Missing authorization on deployment.killProcess/readLogs/removeDeployment and host-level schedule reads (cross-organization)

Severity
Medium 6.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Authorization bypass through a user-controlled key (IDOR) (CWE-639)Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Sources
Project advisories (GitHub)

Description

For deployments that belong to a host-level schedule (scheduleType: "dokploy-server", i.e. no applicationId/composeId and no schedule.serverId), deployment.killProcess performs no authorization check. Any authenticated user of any organization who knows the deploymentId can make the Dokploy server run kill -9 on the Dokploy host. The same gap in schedule.one and deployment.allByType lets that user read the host schedule (including its script) and its deployments, which discloses the deploymentId.

  • Victim org has a host-level ("Dokploy server") schedule. Creating these is owner/admin only.
  • Attacker is a plain member of a different organization on the same instance (or the same org; members cannot list host schedules).
  • Attacker knows the scheduleId or deploymentId (nanoid). I did not find an enumeration path; the reads below disclose the deploymentId once the scheduleId is known.
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References