Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-72737, is an Insecure Direct Object Reference (IDOR) in Dokploy's backup functionality. The core issue lies in the backup.create, backup.update, and backup.restoreBackupWithLogs functions within apps/dokploy/server/api/routers/backup.ts. These functions accept a destinationId parameter controlled by the client but fail to perform an authorization check to ensure that the referenced backup destination belongs to the user's active organization. This missing check (specifically, destination.organizationId === ctx.session.activeOrganizationId) allows an authenticated attacker, with backup permissions in their own organization, to manipulate backup operations to use a destinationId belonging to another organization.
When these vulnerable functions are triggered with a victim's destinationId, the getS3Credentials function in packages/server/src/utils/backups/utils.ts is subsequently called. This function then materializes the victim organization's S3 accessKey and secretAccessKey on the attacker's service host. This leads to severe consequences, including the exposure of sensitive S3 credentials, the ability to read another organization's backup objects (cross-tenant data theft), and the potential to redirect or poison backups across tenant boundaries. The advisory explicitly states that the listBackupFiles function does include the necessary organization ID check, highlighting its absence in the identified vulnerable functions as the root cause.
backup.createapps/dokploy/server/api/routers/backup.ts
backup.updateapps/dokploy/server/api/routers/backup.ts
backup.restoreBackupWithLogsapps/dokploy/server/api/routers/backup.ts
getS3Credentialspackages/server/src/utils/backups/utils.ts