CVE-2026-72734

Name of the Vulnerable Software and Affected Versions Dokploy versions 0.28.7 through 0.29.12

Description The server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and executes the functions haveActiveServices(), findServerById(), removeDeploymentsByServerId(), and deleteServer() without verifying if the currentServer.organizationId matches the ctx.session.activeOrganizationId. This allows an authenticated owner or administrator with server:delete permissions in one organization to delete the server registration and deployment records of another organization if they have previously obtained that organization's serverId. This action can interrupt management and expose the associated plaintext SSH private key.

Recommendations Update to version 0.29.13.