Cross-tenant deletion and key disclosure via unscoped serverId

Authorization bypass in Dokploy 0.28.7 through 0.29.12 allows remote authenticated users to delete another tenant's server records. The server.remove tRPC mutation uses a caller-controlled serverId to delete records and return the linked plaintext SSH private key without comparing the server's organizationId to the active organization. Exploitation requires owner or administrator server:delete permission in one organization and prior knowledge of another organization's serverId; the remote host remains running, but its registration, deployment history, management access, and SSH credential confidentiality are lost.