mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-07-21 22:05:23 +02:00
server.remove deleted a server (and its deployment rows) by caller-supplied serverId without checking it belongs to the active organization, unlike server.one and server.update. An owner/admin of org A could delete org B's server registration. Resolve and compare the server's organizationId before the active-services guard, so cross-org callers are rejected without leaking existence.