Vulnerability details

CVE-2026-45790

Dokploy dokploy

Dokploy: Invitation Role Escalation Allows Organization Takeover

CVSS 3.1

8.0High

Official description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.

CVSS scores

Score	Version	Source	Vector
8.0High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Dokploy	dokploy	< 0.29.6	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/Dokploy/dokploy/pull/4475 x_refsource_MISC
https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08 x_refsource_MISC
https://github.com/Dokploy/dokploy/releases/tag/v0.29.6 x_refsource_MISC
https://github.com/Dokploy/dokploy/security/advisories/GHSA-fm9p-wmpw-gxjh x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-18
Last updated: 2026-08-18
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.41%

Probability of exploitation in 30 days

36.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-269
Improper Privilege Management