CVE-2025-53374: Dokploy PaaS Information Disclosure Flaw

CVE-2025-53374 Overview

CVE-2025-53374 is an information disclosure vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS) for deploying and managing applications and databases. An authenticated low-privileged user can invoke the user.one tRPC procedure to retrieve detailed profile data about other members of the same organization. The response discloses personally identifiable information (PII) including email address, assigned role, two-factor authentication status, organization ID, and account flags. The weakness is categorized as [CWE-359] Exposure of Private Personal Information to an Unauthorized Actor. The fix is available in Dokploy v0.23.7.

Critical Impact
Any authenticated member of a Dokploy organization can enumerate PII belonging to other users in the same organization, enabling reconnaissance for targeted phishing and account takeover.

Affected Products

Dokploy versions prior to v0.23.7
Self-hosted Dokploy PaaS deployments
Multi-tenant Dokploy organizations with non-owner members

Discovery Timeline

2025-07-07 - CVE-2025-53374 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53374

Vulnerability Analysis

The vulnerability resides in the user.one tRPC query handler within apps/dokploy/server/api/routers/user.ts. The procedure was defined as a protectedProcedure, meaning it enforced authentication but did not enforce authorization at the organization or object level. Any authenticated user holding a session token could pass another user's identifier and receive a full membership record. The returned payload exposed email, role, two-factor authentication state, organization ID, and additional account flags useful for profiling targets.

Root Cause

The root cause is broken access control. The handler trusted the caller's authenticated session but omitted a check comparing the requested record to the caller's own identity or elevated role. Classified under [CWE-359], the issue reflects a missing authorization boundary rather than a parsing or injection flaw.

Attack Vector

Exploitation requires valid credentials for an account inside the target organization and network access to the Dokploy API. The attacker calls the user.one endpoint with the identifier of another organization member and parses the response. No user interaction is required on the victim side. The disclosed PII supports phishing campaigns, password-reset abuse, and selective targeting of accounts without two-factor authentication.

typescript

// Security patch applied in apps/dokploy/server/api/routers/user.ts
// feat(user-access): implement access control for user information retrieval
            },
        });

        // If user not found in the organization, deny access
        if (!memberResult) {
            throw new TRPCError({
                code: "NOT_FOUND",
                message: "User not found in this organization",
            });
        }

        // Allow access if:
        // 1. User is requesting their own information
        // 2. User has owner role (admin permissions) AND user is in the same organization
        if (memberResult.userId !== ctx.user.id && ctx.user.role !== "owner") {
            throw new TRPCError({
                code: "UNAUTHORIZED",
                message: "You are not authorized to access this user",
            });
        }

        return memberResult;
    }),

Source: Dokploy commit 61cf426

Detection Methods for CVE-2025-53374

Indicators of Compromise

Repeated tRPC calls to the user.one procedure from a single authenticated session targeting multiple distinct user identifiers.
Access patterns where a non-owner account queries user records that do not match its own userId.
API traffic spikes to /api/trpc/user.one outside typical administrative hours.

Detection Strategies

Review Dokploy application logs for user.one invocations and correlate the requesting user with the queried user identifier.
Deploy a reverse-proxy or WAF rule that counts unique user.one identifier lookups per session over short windows.
Audit organization membership and role assignments to confirm that only owners perform cross-user lookups.

Monitoring Recommendations

Forward Dokploy API access logs to a centralized log platform and alert on enumeration patterns against the user router.
Monitor for suspicious outbound phishing emails sent to addresses that match recently queried Dokploy member accounts.
Track authentication anomalies, including login attempts against accounts whose two-factor status was recently disclosed.

How to Mitigate CVE-2025-53374

Immediate Actions Required

Upgrade all Dokploy instances to version v0.23.7 or later, which enforces the organization and ownership checks in user.one.
Audit organization membership and remove inactive or unknown low-privileged accounts.
Rotate credentials for accounts whose PII may have been exposed and enforce two-factor authentication for all members.

Patch Information

The fix is published in Dokploy v0.23.7 and implemented in commit 61cf426. The patch adds a NOT_FOUND error when the queried user is outside the organization and an UNAUTHORIZED error when the caller is neither the record owner nor an organization owner. See the GitHub Security Advisory GHSA-fcq8-wv2q-f758 and the upstream commit for details.

Workarounds

Restrict Dokploy API exposure to trusted networks or VPN segments until the upgrade is applied.
Limit organization membership to the minimum required set of users to reduce the volume of exposable PII.
Place an authenticating reverse proxy in front of Dokploy and block non-owner callers from the user.one route.

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.23.7
docker service update --image dokploy/dokploy:0.23.7 dokploy

# Verify the running version
docker service inspect --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}' dokploy