---
id: CVE-2026-72734
title: 'Dokploy is a free, self-hostable Platform as a Service (PaaS)'
summary: >-
  Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7
  until 0.29.13, the server.remove tRPC mutation in
  apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId
  and calls haveActiveServices, fin…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L'
cwe:
  - CWE-639
published: '2026-08-10'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:54:37.790'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72734'
references:
  - url: >-
      https://github.com/Dokploy/dokploy/commit/4aee66b2d1dc2c027749a541e553aa49947075c1
    label: security-advisories@github.com
  - url: 'https://github.com/Dokploy/dokploy/pull/4874'
    label: security-advisories@github.com
  - url: 'https://github.com/Dokploy/dokploy/releases/tag/v0.29.13'
    label: security-advisories@github.com
  - url: 'https://github.com/Dokploy/dokploy/security/advisories/GHSA-3rpx-c3j9-q99x'
    label: security-advisories@github.com
  - url: 'https://github.com/Dokploy/dokploy/security/advisories/GHSA-3rpx-c3j9-q99x'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00386
epssPercentile: 0.29911
ingestedAt: '2026-09-08T21:11:12.273Z'
---

## Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.