CVE ID :CVE-2026-45790
Published : Aug. 17, 2026, 10:17 p.m. | 1 hour, 56 minutes ago
Description :Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy’s organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.
Severity: 8.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
Published : Aug. 17, 2026, 10:17 p.m. | 1 hour, 56 minutes ago
Description :Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy’s organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.
Severity: 8.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…