CRITICALVulnerability
CVE-2026-72886
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.
Properties
- severity
- CRITICAL
- score
- 9.9
- epss_score
- 0.00361
- cve_id
- CVE-2026-72886
- vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- published_at
- 2026-08-10T20:17:35.423
- last_modified
- 2026-09-08T20:54:37.790
- epss_percentile
- 0.29193
Related Entities (4)
ENRICHED_BY (1)
→[Source]FIRST EPSS
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (2)
→[Weakness]Improper Privilege Management
→[Weakness]Incorrect Authorization
Explore deeper with Ninja Signal's threat intelligence graph