---
id: CVE-2026-111331
title: >-
  Dokploy through 0.30.8 contains a cross-organization authorization bypass in
  the port tRPC router that allows authenticated owners or admins of any
  organization to manage other tenants' ports because the target application's
  organization…
summary: >-
  Dokploy through 0.30.8 contains a cross-organization authorization bypass in
  the port tRPC router that allows authenticated owners or admins of any
  organization to manage other tenants' ports because the target application's
  organization…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-639
vendor: Dokploy
product: Dokploy
affected:
  - Dokploy <= 0.30.8
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:17:32.157'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111331'
references:
  - url: 'https://github.com/Dokploy/dokploy'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Dokploy/dokploy/blob/v0.30.8/apps/dokploy/server/api/routers/port.ts#L17-L113
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Dokploy/dokploy/blob/v0.30.8/packages/server/src/services/permission.ts#L244-L261
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@hieuPenguinnn/dokploy-port-router-cross-org-idor'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/dokploy-through-0.30.8-cross-organization-authorization-bypass-via-port-trpc-router
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@hieuPenguinnn/dokploy-port-router-cross-org-idor'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00324
epssPercentile: 0.25625
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T16:42:46.799501Z'
ingestedAt: '2026-10-15T22:48:25.453Z'
---

## Overview

Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.