CVE-2026-63505 · Package
NO FIX YET · SEE WHAT TO DO
Probo is a self-hostable GRC platform where a finding can reference a risk from a different organization without a tenant check. An authenticated member of one organization can read another organization's risk name, description, treatment, category, severity and owner, and can block that organization from deleting its own risk.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Probo with more than one organization, or where users in one organization can sign in and create findings. Single-organization deployments with only trusted members have a much smaller exposure. Hosted or single-tenant use with no other organizations present is less exposed.
Not affected if single-organization, version-0.223.1-or-later
Who cares grc, multi-tenant, probo, self-hosted
0.223.1.0.223.1 or later.Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via finding.riskId. That reference is stored without validating that the risk belongs to the caller's organization, and the Finding.risk field resolver authorizes the finding (caller's org) instead of the risk, then loads the risk with a tenant scope derived from the risk's own global ID. As a result, an authenticated member of organization A can attach an arbitrary organization B risk GID to a finding they own and then read organization B's Risk (name, description, treatment, category, severity, owner) — with no membership in B. The stored cross-tenant reference also blocks B from deleting its own risk (ON DELETE RESTRICT), a cross-tenant integrity/DoS. This issue has been patched in version 0.223.1.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.