UpHeron
All vulnerabilities

Servers and applications

GHSA-vxxh-2cp7-gr59

Missing Ownership Check in Application Monitoring Endpoint

Severity
Medium 5.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Authorization bypass through a user-controlled key (IDOR) (CWE-639)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Sources
Project advisories (GitHub)

Description

The readAppMonitoring tRPC procedure is gated by withPermission("monitoring", "read"), which verifies the caller holds the monitoring:read role within their own organization. It does not verify that the supplied appName belongs to the caller's organization before passing it to getApplicationStats.

getApplicationStats queries Docker Swarm by service label with no tenant filter, returning container resource metrics for whichever appName the caller supplies. Every other application-scoped procedure in this router (30 of 31) calls findApplicationById(applicationId) and asserts the returned application's organizationId matches ctx.session.activeOrganizationId before proceeding.

Any authenticated user on a self-hosted multi-tenant Dokploy instance can read container resource metrics (CPU, memory, network I/O, block I/O) for any application by name, including containers belonging to other organizations and the Dokploy control-plane service itself.

From Dokploy/dokploy's security advisory.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References