CVE-2026-72737

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.9

Description An issue exists where the application fails to verify if the destination.organizationId matches the ctx.session.activeOrganizationId when processing requests. This allows an authenticated member with backup permissions in one organization to manipulate the destinationId parameter to access resources of another organization. This can lead to the exposure of S3 accessKey and secretAccessKey via the getS3Credentials() function, unauthorized reading of backup objects, or the redirection and poisoning of backups across tenant boundaries. The affected API endpoints are 'backup.create', 'backup.update', and 'backup.restoreBackupWithLogs'.

Recommendations Update Dokploy to version 0.29.9 or later. As a temporary mitigation, restrict access to the 'backup.create', 'backup.update', and 'backup.restoreBackupWithLogs' endpoints to only highly trusted administrators.