Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.9
CVE-2026-111331: Dokploy lets admins change other tenants' ports
CVE-2026-111331 · published 20 days ago
Summary
In Dokploy versions up to 0.30.8, the system does not check which organization a port belongs to when an admin or owner makes changes. This means an authorized user from one organization can view, modify, or delete port settings for another organization, potentially disrupting how services are exposed. Upgrade to a newer version or apply the vendor's patch to ensure proper organization checks.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | <= 0.30.8 |
Original advisory text
Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.
References
- https://github.com/Dokploy/dokploy Product
- https://hackmd.io/@hieuPenguinnn/dokploy-port-router-cross-org-idor Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1113... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-111331 Vendor Advisory
- https://github.com/Dokploy/dokploy/blob/v0.30.8/apps/dokploy/server/api/routers/... Third Party Advisory
- https://github.com/Dokploy/dokploy/blob/v0.30.8/packages/server/src/services/per... Third Party Advisory
- https://www.vulncheck.com/advisories/dokploy-through-0.30.8-cross-organization-a... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.9
High
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published15 Oct 2026
Updated31 Oct 2026
First seen15 Oct 2026
Track software like this
Free during beta