CVE-2026-72873

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description An issue exists where the endpoint application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by the findApplicationById() function in packages/server/src/services/application.ts without redacting sensitive information. This allows a user with only service:read permission to retrieve another user's Git provider secrets, specifically the githubClientSecret, githubPrivateKey, and githubWebhookSecret variables, even when hasGitProviderAccess is false and unauthorizedProvider is set.

Recommendations Update Dokploy to version 0.29.13.