CVE-2026-72737

Executive Summary

CVE-2026-72737 affects Dokploy versions 0.29.8 and earlier. The vulnerability resides in the backup.create, backup.update, and backup.restoreBackupWithLogs handlers, which accept a client-supplied destinationId without verifying that the referenced destination belongs to the caller's active organization. An authenticated user with backup permissions in one tenant can therefore access another tenant's S3 credentials and backup objects. The CVSS 9.6 score reflects high confidentiality and integrity impact across organizational boundaries in a multi-tenant PaaS environment.

Technical Analysis

The root cause is an authorization check omission in the backup router. The functions backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a destinationId parameter directly from the client. This identifier is passed to getS3Credentials in packages/server/src/utils/backups/utils.ts without confirming that destination.organizationId matches ctx.session.activeOrganizationId. As a result, any authenticated member who possesses backup permissions for a service in their own organization can reference a destination record belonging to a different organization. The flaw maps to CWE-639 (Authorization Bypass Through User-Controlled Key) and enables cross-tenant data access without requiring elevated privileges beyond normal backup rights.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker enumerates exposed Dokploy instances and obtains a valid session token for an account that holds backup permissions inside one organization.
2. The specific flaw class is triggered when the attacker supplies a destinationId value that belongs to a second organization in calls to backup.create, backup.update, or backup.restoreBackupWithLogs.
3. Payload/execution method at the vulnerability-class level: The server resolves the supplied destinationId without performing the organization ownership check, causing getS3Credentials to return the target organization's S3 accessKey and secretAccessKey.
4. Post-exploitation impact: The attacker can read the foreign organization's backup objects, write new or poisoned backups to the same destination, or redirect backup operations across tenant boundaries. No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Successful exploitation allows an attacker to exfiltrate another organization's S3 credentials and backup data, achieving full confidentiality and integrity compromise across tenants. The S:C scope and H values for confidentiality and integrity in the supplied CVSS vector produce the 9.6 score. Affected systems are any self-hosted Dokploy deployments running 0.29.8 or earlier that contain multiple organizations with backup destinations configured. Blast radius is limited to tenants sharing the same Dokploy instance.

Detection Guidance

Sigma Rule

title: Dokploy Cross-Tenant Backup Destination Access
status: experimental
logsource:
  product: linux
  service: dokploy
detection:
  selection:
    event.action: backup.create OR backup.update OR backup.restoreBackupWithLogs
    destinationId: "*"
  condition: selection
fields:
  - user.name
  - organization.id
  - destination.organizationId
level: high

YARA Rule

rule Dokploy_Backup_Authz_Bypass {
    strings:
        $s1 = "backup.create"
        $s2 = "backup.update"
        $s3 = "getS3Credentials"
        $s4 = "activeOrganizationId"
    condition:
        any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Dokploy backup destinationId mismatch"; flow:established,to_server; content:"destinationId"; http_uri; content:"backup.create"; http_uri; sid:1002026; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [process where process.name == "dokploy" and event.action in ("backup.create", "backup.update")]
  [api where api.endpoint in ("/backup.create", "/backup.update") and api.parameter == "destinationId"]

Splunk SPL Query

index=dokploy sourcetype=dokploy:api 
(event.action="backup.create" OR event.action="backup.update" OR event.action="backup.restoreBackupWithLogs") 
| where isnotnull(destinationId) 
| stats count by user, organizationId, destination.organizationId 
| where organizationId != destination.organizationId

Wazuh OSSEC Rule

<rule id="471713" level="12">
  <if_sid>100000</if_sid>
  <match>backup.create|backup.update|backup.restoreBackupWithLogs</match>
  <description>Dokploy cross-organization backup destination access attempt</description>
  <group>pci_dss_10.2.4,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict backup permission grants to trusted users only; monitor API calls that reference destinationId for organization mismatches; place the Dokploy instance behind an additional network access control layer.
2. Patch/upgrade steps: No vendor fix is currently available; monitor the upstream repository for a future release that adds the missing organizationId check.
3. Long-term hardening: Implement explicit ownership verification on every destination reference and adopt least-privilege backup roles scoped to individual organizations.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-72737
https://github.com/Dokploy/dokploy
CISA KEV: Not listed
No known threat actor campaigns or in-the-wild exploitation reported at time of writing.