Summary
Dokploy exposes plaintext Git provider credentials to organization members who are not authorized to access those providers. A member with application read access or a provider identifier may retrieve secrets and use them to access private repositories or manipulate connected external workflows when per-member provider checks are bypassed.
Affected context
The issue occurs in Dokploy deployments where protected procedures return Git provider records or application data containing nested provider relations. It becomes risky when organization membership or application access is treated as sufficient authorization without filtering providers through the requesting member's assigned access. Exposed records may contain OAuth tokens, private keys, client secrets, webhook secrets, or app passwords.
Exploit preconditions
- Attack surface: Protected application and Git provider API procedures
- Required access: Organization membership with applicable application read access, or access to a provider identifier
- Trigger point: Retrieval of provider records or application details through affected routes
- Why exploitation is possible: Authorization checks do not consistently enforce organization boundaries or the member's accessible provider assignments, allowing sensitive fields to be returned
Why this happens
The underlying flaw is an authorization failure in which endpoint-level access does not enforce object-level and field-level authorization. Provider queries return complete records without applying the requesting member's accessible-provider filter or verifying organizational ownership, while application responses include sensitive nested relations regardless of the member's provider access. This maps primarily to CWE-862: Missing Authorization, with CWE-200: Exposure of Sensitive Information describing the resulting disclosure of plaintext credentials.
Potential impact
- An unauthorized member may obtain plaintext provider credentials
- Attackers could access private source repositories
- External repository workflows or integrations could be manipulated
- Exposed signing keys and tokens may enable impersonation of connected applications
- Credential reuse could support lateral movement into development or deployment systems
General mitigation guidance
Mitigation should center on consistent, deny-by-default authorization at the organization, object, and field levels.
Common defensive patterns include:
- Enforcing membership and organization ownership checks for every provider and application lookup
- Filtering results through the requesting member's explicitly assigned provider identifiers
- Returning only the minimum fields required for the requested operation
- Keeping private keys, tokens, client secrets, and webhook secrets out of general application responses
- Separating secret retrieval into tightly controlled operations with explicit authorization and auditing
- Applying least privilege to service accounts and connected Git integrations
- Rotating credentials that may have been exposed and monitoring their use
How teams detect issues like this
Organizations can detect similar issues through:
- Static analysis and code review rules for database queries that return full provider rows
- Review of protected procedures for missing organization, ownership, and per-member access predicates
- API contract tests verifying that unauthorized members receive denial responses or redacted data
- Schema and serialization checks that prevent secrets from appearing in general-purpose response objects
- Policy enforcement requiring object-level authorization before nested relation loading
- Audit-log analysis for unusual provider lookups, secret access, repository activity, or workflow changes
- Automated security review tools that identify missing authorization checks and sensitive-field exposure
