CVE-2026-45790: Dokploy Privilege Escalation Vulnerability

CVE-2026-45790 Overview

CVE-2026-45790 is a privilege escalation vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS). Versions prior to 0.29.6 permit any user holding the member:create permission to invite an account with the owner role. The organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts fails to restrict which roles can be assigned during invitation. A related flaw in packages/server/src/services/user.ts allows a privileged self-hosted user to create accounts with arbitrary roles. Because owner roles cannot be demoted, successful exploitation results in permanent organization takeover. The issue is fixed in version 0.29.6.

Critical Impact
An authenticated low-privileged member can escalate to organization owner and irreversibly seize control of the Dokploy tenant.

Affected Products

Dokploy versions prior to 0.29.6
Self-hosted Dokploy PaaS deployments
Multi-tenant Dokploy organizations with delegated member invitation rights

Discovery Timeline

2026-08-17 - CVE-2026-45790 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45790

Vulnerability Analysis

The vulnerability is a broken access control flaw classified as [CWE-269] Improper Privilege Management. Dokploy's role-based access control model defines an owner role that carries full administrative rights over an organization. The organization.inviteMember tRPC procedure accepts a role parameter from the caller without validating that the caller is permitted to grant that specific role. A user granted only the member:create permission — intended for inviting standard members — can pass owner as the role value.

The secondary path in packages/server/src/services/user.ts compounds the issue. Self-hosted privileged users can create accounts and assign arbitrary roles through the service layer. Because Dokploy provides no mechanism to demote an owner back to a lower role, any escalation is permanent. An attacker retains control even after the original owner attempts remediation.

Root Cause

The root cause is missing authorization checks on the role field of the invite and user-creation flows. The code trusts the client-supplied role value rather than constraining it to a subset the caller is entitled to assign. This is a canonical improper privilege management defect where authorization coverage does not match the sensitivity of the operation.

Attack Vector

Exploitation requires network access to the Dokploy application and an authenticated account with the member:create permission. The attacker calls the organization.inviteMember tRPC endpoint and supplies owner as the target role. The invited account — which the attacker controls — is provisioned with owner-level privileges. Because user interaction is needed to accept the invitation, the attack typically involves inviting an attacker-controlled email address.

// Conceptual illustration of the vulnerable invite call
// (No public PoC published; see the GHSA-fm9p-wmpw-gxjh advisory for details)
trpc.organization.inviteMember.mutate({
  email: "attacker@example.com",
  role: "owner"           // role not validated against caller permissions
});

Source: GitHub Security Advisory GHSA-fm9p-wmpw-gxjh

Detection Methods for CVE-2026-45790

Indicators of Compromise

Unexpected accounts holding the owner role in an organization's member list
Recent invitations issued by non-owner accounts where the assigned role is owner
Newly created user accounts in packages/server/src/services/user.ts audit trails with elevated roles

Detection Strategies

Audit the Dokploy database for members whose role is owner and correlate with the account that issued the invite.
Review application logs for calls to organization.inviteMember where the role parameter equals owner and the caller is not already an owner.
Compare the current owner roster against a known-good baseline captured before the upgrade to 0.29.6.

Monitoring Recommendations

Forward Dokploy application and access logs to a centralized log platform and alert on role-change and invite events.
Monitor authentication events for newly provisioned owner accounts, particularly those created shortly after member-level activity.
Track outbound invitation emails to external domains from lower-privileged accounts.

How to Mitigate CVE-2026-45790

Immediate Actions Required

Upgrade all Dokploy instances to version 0.29.6 or later without delay.
Enumerate every organization's owner list and remove any unauthorized owner accounts identified during the audit.
Rotate credentials and API tokens tied to accounts that may have been provisioned through the vulnerable invite path.

Patch Information

The fix is available in Dokploy 0.29.6. See the GitHub Release v0.29.6, the GitHub Pull Request, and the GitHub Commit Details. The patch enforces role validation in organization.inviteMember and in the user-creation service so that callers cannot assign roles above their own privilege level.

Workarounds

Restrict the member:create permission to fully trusted accounts until the upgrade is completed.
Disable the invitation workflow at the reverse-proxy or firewall layer where feasible to prevent unauthenticated reach to the tRPC endpoint.
Manually verify every existing owner account and remove any that were not explicitly provisioned by an administrator.

bash

# Upgrade Dokploy to the patched release
git fetch --tags
git checkout v0.29.6
pnpm install
pnpm run build
# Restart the Dokploy service according to your deployment method