CVE Feed

    Dashboard / CVE / CVE-2026-45632

    CVE-2026-45632

    Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server write and execute scripts on the host or remote servers, enabling RCE on the Dokploy host or a target server.

    Published:May 29, 2026
    Last Modified:Jun 2, 2026
    EPS:May 29, 2026
    EPSS Score:0.00044
    CVSS Score:9.9

    Affected Products

    Vendor
    Dokploy
    Product
    Dokploy

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-82954 (CVSS 8.6) — A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath…
    CVE-2026-45791 (CVSS 5.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedur…
    CVE-2026-45790 (CVSS 8) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteM…
    CVE-2026-72902 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticat…
    CVE-2026-72901 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticat…
    CVE-2026-72886 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and …
    CVE-2026-72885 (CVSS 0) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by…
    CVE-2026-72884 (CVSS 8.7) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/s…
    CVE-2026-72883 (CVSS 8.8) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in app…
    CVE-2026-72882 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user wh…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High