PT-2025-28202 · Dokploy · Dokploy
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Dokploy versions prior to 0.23.7
Description:
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another user in the same organization by directly invoking the
user.one endpoint. The response discloses personally-identifiable information (PII) such as email address, role, two-factor status, organization ID, and various account flags.Recommendations:
For versions prior to 0.23.7, update to version 0.23.7 to resolve the issue. As a temporary workaround, consider restricting access to the
user.one endpoint to minimize the risk of exploitation.Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Dokploy