Organization takeover via owner-role assignment

Privilege escalation in Dokploy before 0.29.6 allows remote authenticated users to take over an organization via owner-role assignment. The organization.inviteMember tRPC procedure accepts and stores attacker-chosen role values without verifying whether the inviter may delegate owner, and the user.createUserWithCredentials path on self-hosted instances likewise permits arbitrary role assignment during account creation. Any account with member:create permission, including admin-role members by default, can create an owner account that Dokploy later refuses to demote through its role-management flow, making the takeover persistent until out-of-band recovery.