Descripción
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy-s organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.
CVSS 8EPSS 0.28400000000000003%Riesgo 0.82
Ver fuente- Publicación
- 2026-08-17 22:17:14
- Versiones afectadas
- <0.29.6
- Tipo
- Aplicación web
- Última modificación
- 2026-08-18 16:17:09
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H