GHSA-fj57-g9cq-fwvq

Dokploy v0.30.2 added organization/access checks to the GitHub-provider read route, but the sibling github.update mutation does not authorize either caller-controlled identifier. An authenticated administrator in Organization A can supply Organization B's gitProviderId and githubId. The mutation updates the victim parent provider by global ID and sets its organizationId to the attacker's active organization, while the credential-bearing GitHub row remains attached to that parent.

After this reassignment, the existing guarded github.one route treats the victim provider as belonging to Organization A and returns the stored GitHub client secret, private key, installation ID, and webhook secret to the attacker. The victim simultaneously loses access to the provider.

I reproduced the full HTTP state transition against the published dokploy/dokploy:v0.30.2 image. Before the mutation, the victim read returned HTTP 200 and the attacker's read returned HTTP 404.