CVE-2026-45790
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Dokploy prior to 0.29.6 allows a user with member:create permission to invite an account with the owner role, and a privileged self-hosted user can create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted.
Risk Assessment
An attacker can take over the entire organization, leading to full compromise of data and resources.
Recommendation
Update Dokploy to version 0.29.6 or later and review user permissions.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.