What’s Vulnerable › Vulnerabilities

CVE-2025-53374: Dokploy Improperly Discloses User Information via user.one Endpoint

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-07 · updated 2026-06-17
• Weakness: CWE-359

Description

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The response discloses personally-identifiable information (PII) such as e-mail address, role, two-factor status, organization ID, and various account flags. The fix will be available in the v0.23.7.

Affected products

• dokploy: before 0.23.7 — fixed in 0.23.7

How to fix

Upgrade to a fixed version: dokploy 0.23.7. Check the vendor advisory for mitigations.

References

• https://github.com/Dokploy/dokploy/commit/61cf426615a4aa095b150362526aa52f2d1ea115
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-fcq8-wv2q-f758

Get alerted when CVE-2025-53374 or the next vulnerability affects your stack