Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server write and execute scripts on the host or remote servers, enabling RCE on the Dokploy host or a target server.
Problem types
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-269: Improper Privilege Management
CWE-862: Missing Authorization
Product status
References
github.com/...okploy/security/advisories/GHSA-7wmr-57mg-h5q6
github.com/...okploy/security/advisories/GHSA-7wmr-57mg-h5q6