UpHeron
All vulnerabilities

Servers and applications

GHSA-xjv4-wwvv-vq3m

Read-only Viewer can deploy applications and Compose stacks through exposed webhook tokens

Severity
Medium 5.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Information exposure (CWE-200)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Slow it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Sources
Project advisories (GitHub)

Description

The predefined Viewer role may inspect an assigned service and its deployment history. It lacks deployment:create and should not receive a bearer token that bypasses that permission.

Dokploy's application and Compose detail procedures authorize only service:read and return the complete database object, including its refreshToken.

The returned refreshToken is a bearer credential for the unauthenticated deployment webhook. Supplying it to /api/deploy/[refreshToken] or /api/deploy/compose/[refreshToken] queues a deployment without checking the caller's session or deployment permission. Docker applications accept an empty request body and use the configured image. Raw Compose services skip all provider-event checks.

The predefined Viewer role has service:read and deployment:read, but lacks deployment:create. Dokploy's application and Compose detail procedures authorize only service:read and return the complete database object, including its refreshToken.

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References