UpHeron
All vulnerabilities

Servers and applications

GHSA-fx4f-j8fj-2q69

Cross-organization IDOR across ~145 tRPC handlers via checkServicePermissionAndAccess / checkServiceAccess owner/admin bypass (CVE-2026-43917 missed siblings) + swarm topology

Severity
Critical 9.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Authorization bypass through a user-controlled key (IDOR) (CWE-639)Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

The shared authorization helpers checkServicePermissionAndAccess and checkServiceAccess (packages/server/src/services/permission.ts:242-289), used by most service-router handlers, verify the caller's ROLE in the caller's OWN active organization and then check an accessedServices membership list ONLY for non-owner/non-admin roles. For role === "owner" || "admin" the access check is skipped entirely, and in NO branch is the target resource's organizationId ever compared to ctx.session.activeOrganizationId.

Because organization.create is a plain protectedProcedure (organization.ts:17), any authenticated user can self-create an organization and become its owner (PR:L). An owner of org A can therefore pass an org-B resource id (applicationId, composeId, postgresId, domainId, serverId, ...) to any helper-only handler and operate on the victim organization's resource.

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References