GHSA-v2pj-9x4j-7hcj

Dokploy allows an authenticated user to update a server object with an arbitrary sshKeyId. The update path verifies that the target server belongs to the active organization, but it does not verify that the supplied SSH key belongs to the same organization. As a result, a user can attach another organization's SSH key to a server they control.

This is similar with CVE-2025-22609. In the original vulnerability, a missing authorization check allowed an authenticated user to attach an existing private key from the Coolify instance to their own server and then use terminal access to execute commands on an SSH target that accepted that key.

• The server update route authorizes the server, but not the supplied SSH key.

The source is attacker-controlled sshKeyId in the server.update mutation input. The route only checks server.organizationId; it does not load the referenced SSH key and compare sshKey.organizationId with ctx.session.activeOrganizationId.