GHSA-wc7v-rjjv-9g7g

Removing a member from an organization should terminate that member's organization-scoped API access as well as the interactive membership.

Organization-scoped API keys are attached to the global user and store their organization only as JSON metadata. Removing the user from an organization deletes the membership but neither revokes those keys nor invalidates them during authentication.

validateRequest() verifies the key, reads its old organizationId, and queries the current membership. When no membership exists, it still creates an authenticated session with that former organization ID and a fallback member role. The cookie-session branch correctly clears the active organization in the same situation.

This gives a removed member persistent access to every authentication-only route. In the current release, that includes settings.getWebServerSettings, which exposes the stored SSH private key and monitoring token, and /listen-deployment, which can stream Dokploy's local SSH private…