Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-72886, describes an incomplete fix for a previous issue where non-admin members could gain root on the host by bypassing owner/admin checks on server-level schedules. The core problem was that the authorization gate for host-level schedules was only applied in a specific code branch (the 'else' branch when no serviceId was present). If a serviceId (derived from applicationId or composeId) was attached to a dokploy-server schedule, the owner/admin check was entirely skipped. This allowed a member with access to an application to link it to a host-level schedule and then execute arbitrary commands as root via schedule.runManually.
The provided commit 1e3f10bd22c1c28a7b65a2d7ac15a0a5e47599eb directly addresses this issue. The fix involves extracting the host-level authorization logic into a new, dedicated function assertHostScheduleAccess in packages/server/src/services/schedule.ts. This new function encapsulates all the necessary checks for dokploy-server and server schedule types, including role verification (owner/admin) and server access.
Crucially, this assertHostScheduleAccess function is then called unconditionally at the beginning of the create, update, delete, and runManually mutations within apps/dokploy/server/api/routers/schedule.ts, before any logic that checks for serviceId. This ensures that the host-level authorization is always applied, regardless of whether a serviceId is present. The removed code blocks in the else branches of these functions confirm the previous, incomplete authorization logic.
Therefore, the functions scheduleRouter.create, scheduleRouter.update, scheduleRouter.delete, and scheduleRouter.runManually were vulnerable because they contained the flawed authorization logic that allowed the bypass. An attacker would trigger these functions with a crafted request including a serviceId to bypass the owner/admin check and then use runManually to execute commands as root.
scheduleRouter.createapps/dokploy/server/api/routers/schedule.ts
scheduleRouter.updateapps/dokploy/server/api/routers/schedule.ts
scheduleRouter.deleteapps/dokploy/server/api/routers/schedule.ts
scheduleRouter.runManuallyapps/dokploy/server/api/routers/schedule.ts