Probo: Cross-tenant authorization bypass exposes risk data of other organizations
Summary
Probo is a self-hostable governance, risk and compliance (GRC) platform. In versions before 0.223.1, an authenticated member of one organization can attach a Risk from another organization to a Finding they own and then read that Risk's name, description, treatment, category, severity and owner. The stored reference also prevents the other organization from deleting its own risk.
Affected
- Probo (getprobo) versions before 0.223.1
- Affected component: console GraphQL API, Finding.risk resolver
Fixed in
- Fixed in 0.223.1 (release probod/v0.223.1, 2026-07-03)
- Upgrade to 0.224.0 or later, which also fixes CVE-2026-76080 and CVE-2026-76079
Workaround
- Unknown.
- Interim measures: restrict console and API access to known users, remove accounts of people outside the organization, and keep the instance behind VPN or SSO until upgraded.
Exploitation
- A public proof of concept is listed on Exploit-DB (EDB-52650). The author describes it as a local test harness.
- No evidence of exploitation in the wild; the CVE is not listed in CISA KEV.
Our recommendation
- Upgrade to 0.224.0 or later.
- Check whether Findings reference Risks from other organizations.
- Review Probo logs for unusual GraphQL queries on risk objects.
- Restrict console access to known users and keep the instance off the public internet where possible.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Exploit-DB EDB-ID 52650 – Probo 0.222.2 - IDOR 17 Aug 2026
Research sources
- CVE Record CVE-2026-63505 www.cve.org
- GitHub Security Advisory GHSA-c74x-79w6-63jh github.com
- Release probod/v0.223.1 github.com
- Fix commit d03f607 github.com
- Exploit-DB 52650 www.exploit-db.com
- VulDB 435929 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:50.
Original description (NVD)
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via finding.riskId. That reference is stored without validating that the risk belongs to the caller's organization, and the Finding.risk field resolver authorizes the finding (caller's org) instead of the risk, then loads the risk with a tenant scope derived from the risk's own global ID. As a result, an authenticated member of organization A can attach an arbitrary organization B risk GID to a finding they own and then read organization B's Risk (name, description, treatment, category, severity, owner) — with no membership in B. The stored cross-tenant reference also blocks B from deleting its own risk (ON DELETE RESTRICT), a cross-tenant integrity/DoS. This issue has been patched in version 0.223.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.