CVE-2026-45790

The vulnerability in Dokploy (CVE-2026-45790) is a privilege escalation that allows arbitrary owner-role assignment through two separate code paths that were never designed to share a common authorization model. This isn't a missing permission check — it's an architectural contradiction between the tRPC procedure in organization.ts (handling user invitations) and user.ts (handling direct account creation), likely built by different teams for different contexts. Both permit owner-role assignment without centralized enforcement. The most critical severity factor is permanence. Once an attacker elevates to owner, the application provides no demotion mechanism. Recovery requires database-level intervention or a full instance reset — this elevates the impact beyond what CVSS 8.0 captures. The EPSS score of 0.00284 reflects Dokploy's niche status, but self-hosted deployments face compounding exposure: the unpatched window extends until an operator runs updates, and there's no forensic trace since the invite path creates legitimate user accounts. For self-hosted operators: first, audit your organization for unexpected owner accounts by querying the users table for role='owner' where you can't account for the creation. Second, if you find suspicious owners, you'll need to manually update their role in the database — the application UI won't help. Third, review any automation or provisioning scripts that depend on user.ts; the 0.29.6 patch may block legitimate infrastructure workflows, creating pressure to bypass the fix. Fourth, treat any pre-patch compromise as permanent unless you've done explicit forensic analysis — assume the attacker has redundant footholds. The deeper risk is architectural. If user.ts remains an active privileged path for infrastructure provisioning, patching organization.ts only closes one door while the other stays open by design. The fix likely hardcodes checks rather than introducing a centralized role-authorization gate — expect similar vulnerabilities as new capabilities get added assuming 'owner equals trusted by default.'

Reviewed through automated stages and approved by a human before publication.