mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-10-19 07:01:35 +00:00
Mauricio Siu
4b7a6295fc
validateDomain accepted an arbitrary serverId and used it to look up the server and SSH into it, without checking it belonged to the caller's active organization. A member with domain:read could probe other orgs' servers and get their SSH/detected IPs back in the response. Addresses greptile review on #5214