UpHeron
All vulnerabilities

Servers and applications

GHSA-r6pv-8cgq-pvxv

Missing authorization on all network.* endpoints (Member -> create/delete docker networks on org servers, cross-org access via serverId)

Severity
High 8.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Sources
Project advisories (GitHub)

Description

Every procedure in networkRouter is a plain protectedProcedure with no permission check (routers/network.ts). Any authenticated user, including members with zero docker-related permissions, can create, inspect, recreate, import and delete docker networks.

Verified live: a member account with no permissions called network.create and a docker network was created on the server.

All of these are protectedProcedure only:

  • network.all, network.networksToSync, network.one, network.inspect — read/list
  • network.create, network.import, network.recreate, network.resync — create/modify
  • network.remove — delete

Members have no docker permission at all (access-control.ts:179 — docker: []), yet all of the above succeed.

one, inspect, recreate, resync and remove do check network.organizationId === activeOrganizationId, so they are limited to the caller's org.

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References