CVE-2026-45790

8.0 Élevée

Publiée le 18/08/2026 à 00:17 · Modifiée le 08/09/2026 à 23:03 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.

Traduire en français

Produits concernés

dokploy

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.0 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-269

Références

https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08
https://github.com/Dokploy/dokploy/pull/4475
https://github.com/Dokploy/dokploy/releases/tag/v0.29.6
https://github.com/Dokploy/dokploy/security/advisories/GHSA-fm9p-wmpw-gxjh
https://github.com/Dokploy/dokploy/security/advisories/GHSA-fm9p-wmpw-gxjh

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories