Log in Start free

Vulnerability · Published Aug 17, 2026 · Assigned by GitHub_M

CVE-2026-45790Dokploy: Invitation Role Escalation Allows Organization Takeover

High 8.0

In plain English

A high-severity privilege mismanagement in dokploy from Dokploy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.4%top 63.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.

Affected products (as reported)

VendorProductVersions
Dokploy dokploy < 0.29.6

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References