CVE-2026-72886
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.46%
- CWE
- CWE-269, CWE-863
- Published
- 2026-08-10
- Last modified
- 2026-08-10
Affected products
- Dokploy dokploy
Weakness type
Related vulnerabilities
- CVE-2026-84869 — ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
- CVE-2026-79090 — Improper privilege management in Actor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging soci
- CVE-2026-79226 — Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker
- CVE-2026-78999 — Improper privilege management in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had co
- CVE-2026-73269 — Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa
- CVE-2026-9193 — Privilege escalation in Progress MarkLogic Server Hadoop integration
- CVE-2026-8709 — Privilege escalation in Progress MarkLogic Server REST document patch operation
- CVE-2026-7329 — Privilege escalation in Progress MarkLogic Server REST query interfaces