CVE-2026-72873

CVE-2026-72873 in Dokploy allows any user with the service:read role to retrieve Git provider credentials (tokens, private keys, webhook secrets) through the application.one API endpoint. The vulnerability exists because the underlying service function findApplicationById loads provider relations as a side effect, and the API layer returns that data without applying existing authorization checks — specifically hasGitProviderAccess, which exists in the codebase but wasn't enforced at this endpoint. This isn't a missing permission check; it's a structural mismatch where service-layer convenience (loading complete relations for internal use) collides with API-layer assumptions (treating returned data as already authorization-screened). The blast radius here exceeds typical secret leakage. Git provider tokens in a PaaS context don't just expose repository access — they control the CI/CD pipeline. A compromised githubPrivateKey or webhook secret can authorize new deployments, exfiltrate secrets from build logs, or enable lateral movement into the repository itself. The half-life of such credentials in self-hosted infrastructure tends to be months, not days, because infrastructure-level tokens rarely follow enforced rotation schedules. For defenders: verify whether users with service:read can retrieve provider data by calling application.one with a low-privilege account. If you're on version 0.29.13 or later, the patch should block this — confirm the fix applies redaction at the API layer rather than just closing the specific endpoint, which would leave the same data accessible through other paths. Audit other endpoints that consume findApplicationById for the same pattern. Implement integration tests that exercise every read endpoint with a restricted-user persona asserting secret-bearing fields are absent. The deeper lesson: permission predicates like hasGitProviderAccess are evidence of awareness, not coverage. Their existence in the codebase creates a false confidence that authorization is complete when it's actually partial. Treat service-layer functions as returning untrusted data by default, and apply redaction defensively at every API boundary.

Reviewed through automated stages and approved by a human before publication.