A critical authorization bypass and command injection vulnerability in Dokploy versions prior to 0.29.13 enables cross-tenant command execution and total system compromise.

This flaw involves an authorization bypass (CWE-639, CWE-862) combined with OS command injection (CWE-78), where the application fails to validate organization ownership before performing operations on server resources. An authenticated user with read-only permissions can trigger command execution on servers belonging to other tenants.

This vulnerability represents a catastrophic failure of multi-tenancy isolation. With a CVSS score of 9.9, an attacker can pivot between environments, execute arbitrary code on remote servers, and access data across the entire platform, leading to severe reputational and operational damage.

Immediate Action: Upgrade to Dokploy version 0.29.13 or later to enforce proper authorization checks and sanitize command inputs.

Proactive Monitoring: Review audit logs for unauthorized access attempts to server IDs or unexpected cross-tenant activity.

Compensating Controls: Implement strict network-level isolation between different customer environments if immediate patching is delayed.

Public Exploit Available: No (exploit_available: false)

Given the availability of a proof-of-concept and the critical nature of the vulnerability, patching must be treated as an emergency task. Administrators should verify the update to version 0.29.13 is applied across all instances to prevent unauthorized cross-tenant access.