Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validate organization membership but do not enforce checkServiceAccess, accessedServerIds, or accessedServices, allowing an authenticated organization member to obtain root terminal access and read logs or statistics for restricted servers and services. This issue is fixed in version 0.29.13.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
dokploy:dokploy
References 5
https://github.com/Dokploy/dokploy/security/advisories/GHSA-qf9j-c9p4-r4xp
https://github.com/Dokploy/dokploy/security/advisories/GHSA-qf9j-c9p4-r4xp
https://github.com/Dokploy/dokploy/pull/4865
https://github.com/Dokploy/dokploy/pull/4865
https://github.com/Dokploy/dokploy/commit/1bc76e9e5b8a9acd14a58cd8a1828c25918f1…
https://github.com/Dokploy/dokploy/commit/1bc76e9e5b8a9acd14a58cd8a1828c25918f162e
https://github.com/Dokploy/dokploy/commit/68f5afae42fca353dcb3d3bc6219ffe9e168c…
https://github.com/Dokploy/dokploy/commit/68f5afae42fca353dcb3d3bc6219ffe9e168cb91
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13