CVE-2026-72883 affects Dokploy versions 0.29.13 and earlier. The vulnerability is a WebSocket authorization bypass where terminal access, logs, and real-time statistics are exposed to any organization member without enforcing service-level access controls.
The core issue: Dokploy correctly implements fine-grained authorization functions (checkServiceAccess, accessedServerIds, accessedServices) for its REST API endpoints. These functions verify whether a user actually has permission to access a specific server or service. However, the WebSocket handlers that power the terminal, logs, and statistics features only validate that the connecting user belongs to the correct organization — they never call the access control functions. In a multi-tenant PaaS context, this means any org member can pivot to terminal access on any server within that organization, achieving code execution as root on infrastructure they shouldn't touch.
The fix shipped in version 0.29.14. If you're running Dokploy, verify your current version immediately and upgrade. More importantly, treat this as a pattern audit: identify every WebSocket or real-time endpoint in your deployment and confirm it enforces the same authorization checks as its REST API equivalents. The vulnerability wasn't that security code was missing — it existed, was correctly implemented, and simply wasn't connected to the handler type handling the highest-privilege operations.
For security architecture in real-time systems: authentication at connection time ('you are who you claim') is not authorization ('you can access this resource'). WebSocket protocols don't enforce authorization at the handshake, so you must explicitly wire it. The Dokploy case is a textbook example of coarse-grained connection auth persisting because developers assumed authenticated users had narrower blast radius than they actually do — particularly dangerous in infrastructure platforms where terminal access means code execution, not data read.