UpHeron
All vulnerabilities

Servers and applications

GHSA-m7rq-qhjp-cmgm

Users can overwrite server-managed fields on their own account via `user.update`

Severity
High
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Mass assignment (CWE-915)
Sources
Project advisories (GitHub)

Description

user.update lets a user edit their profile, but the update schema is createSchema.partial() (db/schema/user.ts:235), so every column on the user table is writable, and the router passes the input straight to updateUser(ctx.user.id, input) (routers/user.ts:273).

Confirmed on dokploy.com: one request set serversQuantity to 999 on my own account (reverted afterwards). Fields that should be server-managed are client-writable, including:

  • serversQuantity: bypasses the plan limit on how many servers you can add
  • expirationDate: self-extend a trial/subscription
  • banned: self-unban
  • enablePaidFeatures / enableEnterpriseFeatures: flip feature flags
  • emailVerified, stripeCustomerId, licenseKey, allowImpersonation, ...

The role and isValidEnterpriseLicense fields are correctly omitted, so this is not a direct privilege escalation.

The stripeCustomerId field makes this more serious. It is the key used to resolve a user's billing identity:

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References