جزئیات آسیب‌پذیری

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.

• https://github.com/Dokploy/dokploy/pull/4874 x_refsource_MISC
• https://github.com/Dokploy/dokploy/commit/4aee66b2d1dc2c027749a541e553aa49947075c1 x_refsource_MISC
• https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 x_refsource_MISC
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-3rpx-c3j9-q99x x_refsource_CONFIRM