{"id":"CVE-2026-76079","kind":"vulnerability","aliases":["CVE-2026-76079"],"related":[],"title":"Probo: organization admin can grant themselves owner role","description":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0.","summary":"Probo is a self-hostable governance, risk, and compliance platform for engineering and security teams. Before version 0.224.0, an organization admin could create a user with the owner role, bypassing the owner-only authorization check, which gives them full control of the organization.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grc","package","probo","self-hosted"],"not_affected_if":["managed-hosting","version-0.224.0-or-later"],"how_to_check":"- Check the Probo version you run; it is affected if it is below `0.224.0`.\n- Look at the Probo deployment's package or image tag to find the running version.","fix":"- Upgrade Probo to `0.224.0` or later.","status":"open","published_at":"2026-11-11T19:17:44+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","triaged_at":"2026-11-11T19:30:13+00:00","updated_at":"2026-11-11T19:30:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T19:30:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Probo to `0.224.0` or later.","reach":"network","title":"Probo: organization admin can grant themselves owner role","impact":"medium","summary":"Probo is a self-hostable governance, risk, and compliance platform for engineering and security teams. Before version 0.224.0, an organization admin could create a user with the owner role, bypassing the owner-only authorization check, which gives them full control of the organization.","audience":"businesses","category":"package","nicknames":[],"who_cares":["probo","self-hosted","grc"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"an admin becomes organization owner and controls all governance data","analyst_note":"","how_to_check":"- Check the Probo version you run; it is affected if it is below `0.224.0`.\n- Look at the Probo deployment's package or image tag to find the running version.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.224.0-or-later","managed-hosting"],"who_is_affected":"Teams that self-host Probo versions before 0.224.0 and give users the organization admin role. The flaw lets an admin escalate to owner, so only organizations with admin users that should not hold owner rights are at real risk. Teams on a newer version, or who do not self-host Probo, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4600,"output_tokens":507,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-76079':11A,14A '0.224.0':39B,87C,115C 'admin':3A,42B,90C 'author':56B,106C 'built':78C 'bypass':51B,98C 'check':57B 'complianc':30B,75C 'control':62B 'could':43B 'creat':44B 'createus':97C 'cve':9A,12A 'engin':33B,80C 'full':61B 'gate':107C 'give':59B 'govern':27B,72C 'grant':5A 'grc':15B,76C 'host':20B 'hostabl':26B,71C 'issu':109C 'membership':95C 'mint':92C 'organ':2A,41B,65B,89C 'owner':7A,49B,54B,94C,101C,105C 'owner-on':53B,100C 'packag':16B 'patch':112C 'platform':31B,77C 'prior':84C 'probo':1A,17B,21B,66C 'risk':28B,73C 'role':8A,50B 'secur':35B,82C 'self':19B,25B,70C 'self-host':18B,24B,69C 'set':104C 'set-own':103C 'team':36B,83C 'user':46B 'version':38B,86C,114C 'via':96C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Probo versions before 0.224.0 and give users the organization admin role. The flaw lets an admin escalate to owner, so only organizations with admin users that should not hold owner rights are at real risk. Teams on a newer version, or who do not self-host Probo, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["grc","high","package","probo","selfhosted"],"campaign_type":null,"search_a":"'-2026':10A,13A '-76079':11A,14A 'admin':3A 'cve':9A,12A 'grant':5A 'organ':2A 'owner':7A 'probo':1A 'role':8A","search_b":"'0.224.0':39B 'admin':42B 'author':56B 'bypass':51B 'check':57B 'complianc':30B 'control':62B 'could':43B 'creat':44B 'engin':33B 'full':61B 'give':59B 'govern':27B 'grc':15B 'host':20B 'hostabl':26B 'organ':41B,65B 'owner':49B,54B 'owner-on':53B 'packag':16B 'platform':31B 'probo':17B,21B 'risk':28B 'role':50B 'secur':35B 'self':19B,25B 'self-host':18B,24B 'team':36B 'user':46B 'version':38B","search_c":"'0.224.0':87C,115C 'admin':90C 'author':106C 'built':78C 'bypass':98C 'complianc':75C 'createus':97C 'engin':80C 'gate':107C 'govern':72C 'grc':76C 'hostabl':71C 'issu':109C 'membership':95C 'mint':92C 'organ':89C 'owner':94C,101C,105C 'owner-on':100C 'patch':112C 'platform':77C 'prior':84C 'probo':66C 'risk':73C 'secur':82C 'self':70C 'self-host':69C 'set':104C 'set-own':103C 'team':83C 'version':86C,114C 'via':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-09T10:12:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76079","severity":null,"published_at":"2026-11-11T19:17:44+00:00","modified_at":"2026-11-11T19:17:44+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","fetched_at":"2026-11-11T19:28:48+00:00","note":null}],"documents":[{"id":128156,"url":"https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128158,"url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128163,"url":"https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-09T10:12:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}