CVE-2026-72886

Name of the Vulnerable Software and Affected Versions Dokploy versions 0.29.2 through 0.29.12

Description In the apps/dokploy/server/api/routers/schedule.ts file, the schedule.create and schedule.update endpoints derive the serviceId from the applicationId or composeId. Due to an error where the owner/admin host-schedule gate is only executed in the alternative branch, a member with access to a single application can attach its applicationId to a dokploy-server schedule. This allows the user to execute a supplied script as root via the schedule.runManually function.

Recommendations Update to version 0.29.13.