Probo: Vertical privilege escalation via createUser allows ADMIN to become OWNER
Summary
Probo, a self-hostable GRC platform, lets an organization ADMIN create an OWNER membership through the createUser function. This bypasses the owner-only authorization check that normally protects ownership changes. An attacker who already holds an ADMIN account in the same organization can take full control of the tenant, including compliance and risk data.
Affected
- Probo versions before 0.224.0
Fixed in
- Fixed in Probo 0.224.0
Workaround
- No vendor-documented workaround. Upgrading to 0.224.0 or later is the fix.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- Requires an existing ADMIN account in the same organization (PR:H).
Our recommendation
- Upgrade all self-hosted Probo instances to 0.224.0 or later.
- Review OWNER memberships and recently created users for unexpected entries, and check audit logs for ADMIN actions.
- Limit the number of ADMIN accounts until the upgrade is done.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-76079 www.cve.org
- Probo release 0.224.0 github.com
- Fix commit eb9274f github.com
- Fix pull request #1475 github.com
- GitHub Security Advisory GHSA-cppp-g98f-gfpp github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:37.
Original description (NVD)
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0.
NVD references (5)
- https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32
- https://github.com/getprobo/probo/pull/1475
- https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0
- https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp
- https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.