CVE-2026-72883

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description Dokploy is a self-hostable Platform as a Service (PaaS). An authenticated organization member can obtain root terminal access and read logs or statistics for restricted servers and services. This occurs because WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validate organization membership but fail to enforce checkServiceAccess, accessedServerIds, or accessedServices.

Recommendations Update to version 0.29.13.