CVE-2026-76079 · Package
NO FIX YET · SEE WHAT TO DO
Probo is a self-hostable governance, risk, and compliance platform for engineering and security teams. Before version 0.224.0, an organization admin could create a user with the owner role, bypassing the owner-only authorization check, which gives them full control of the organization.
first public Jul 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Probo versions before 0.224.0 and give users the organization admin role. The flaw lets an admin escalate to owner, so only organizations with admin users that should not hold owner rights are at real risk. Teams on a newer version, or who do not self-host Probo, can skip it.
Not affected if managed-hosting, version-0.224.0-or-later
Who cares grc, probo, self-hosted
0.224.0.0.224.0 or later.Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.