GHSA-pwg8-2x8c-wc2m

Incomplete fix of GHSA-899j-cjwp-v4gw / GHSA-7r6p-v9gw-pwc8.

Since v0.29.13 the container WebSocket handlers (/docker-container-terminal, /docker-container-logs, /listen-docker-stats-monitoring) authorize through canAccessDockerOverWss() in apps/dokploy/server/wss/authorize.ts. When the client sends a serviceId query parameter, the function only checks that the caller has read access to that service and returns true. It never checks that the requested containerId (or appName for stats) belongs to that service.

Any member who has read access to at least one service — including a service they created themselves — can pass that service's id together with an arbitrary containerId and:

• open a root shell in any container on the host or on any remote server, including the Dokploy panel container (dokploy), which mounts /var/run/docker.sock → root on the Docker host;
• stream logs of any container (other members' applications, dokploy-postgres, dokploy-redis, Traefik);
• read stats of…