CVE-2026-43917

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.19.0 and earlier, the protectedProcedure middleware only verifies the user is authenticated - it does NOT enforce organization scoping. Each endpoint must individually verify the resource's org matches the session's activeOrganizationId. This affects the following endpoints: allByType, killProcess, and removeDeployment in deployment.ts; delete in rollbacks.ts; create, one, update, remove, manualBackupPostgres, MySql, Mariadb, Mongo, Compose, WebServer, and listBackupFiles in backup.ts; list, one, delete, update, runManually, and restoreVolumeBackupWithLogs in volume-backups.ts; getNodes, removeWorker, addWorker, and addManager in cluster.ts; and create in mount.ts.

• CWE-639

• https://github.com/Dokploy/dokploy/security/advisories/GHSA-f8wj-5c4w-frhg

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43911Vaultwarden is a Bitwarden-compatible server written in Rust…8.1
• CVE-2026-43912Vaultwarden is a Bitwarden-compatible server written in Rust…8.7
• CVE-2026-43913Vaultwarden is a Bitwarden-compatible server written in Rust…8.1
• CVE-2026-43914Vaultwarden is a Bitwarden-compatible server written in Rust…9.8
• CVE-2026-43915Coturn is a free open source implementation of TURN and STUN…5.4
• CVE-2026-43916pam_authnft is a PAM session module binding nftables firewal…8.7
• CVE-2026-43918FOSSBilling is a free, open-source billing and client manage…8.7
• CVE-2026-43919Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-4392A vulnerability was detected in TeamSpeak 3 Server up to 3.1…6.9
• CVE-2026-43920FOSSBilling is a free, open-source billing and client manage…6.9
• CVE-2026-43921FOSSBilling is a free, open-source billing and client manage…8.9
• CVE-2026-43924FOSSBilling is a free, open-source billing and client manage…4.8