---
id: "CVE-2026-63505"
page: "https://infrastack.ai/live/CVE-2026-63505"
kind: "vulnerability"
aliases: ["CVE-2026-63505"]
title: "Probo: authenticated tenants can read other organizations' risk records"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["grc", "multi-tenant", "package", "probo", "self-hosted"]
not_affected_if: ["single-organization", "version-0.223.1-or-later"]
published_at: "2026-11-11T19:17:43+00:00"
first_seen_at: "2026-11-11T19:28:47+00:00"
updated_at: "2026-11-11T19:30:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63505", "first_seen_at": "2026-11-11T19:28:47+00:00"}]
exploit_sources: []
---

# Probo: authenticated tenants can read other organizations' risk records

Link for people: https://infrastack.ai/live/CVE-2026-63505 (this .md is for agents)

Probo is a self-hostable GRC platform where a finding can reference a risk from a different organization without a tenant check. An authenticated member of one organization can read another organization's risk name, description, treatment, category, severity and owner, and can block that organization from deleting its own risk.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Probo version; affected versions are those before `0.223.1`.
- Confirm whether your Probo instance is reachable by users from more than one organization.

## Fix

- Probo: upgrade to `0.223.1` or later.

## Timeline

- 2026-11-11T19:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63505

## Documents

- [advisory] Vendor advisory: github.com https://github.com/getprobo/probo/security/advisories/GHSA-c74x-79w6-63jh
- [fix] Patch: github.com https://github.com/getprobo/probo/commit/d03f6077ddf85ad448cbcb2145341d9543fc4711
- [fix] Release notes: github.com https://github.com/getprobo/probo/releases/tag/probod%2Fv0.223.1

## From the sources

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via finding.riskId. That reference is stored without validating that the risk belongs to the caller's organization, and the Finding.risk field resolver authorizes the finding (caller's org) instead of the risk, then loads the risk with a tenant scope derived from the risk's own global ID. As a result, an authenticated member of organization A can attach an arbitrary organization B risk GID to a finding they own and then read organization B's Risk (name, description, treatment, category, severity, owner) — with no membership in B. The stored cross-tenant reference also blocks B from deleting its own risk (ON DELETE RESTRICT), a cross-tenant integrity/DoS. This issue has been patched in version 0.223.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_