PROBO · CVE-2026-76080 · Other
NO FIX YET · SEE WHAT TO DO
Probo is a self-hosted governance, risk and compliance platform whose public Trust Center GraphQL API accepts a client-supplied object ID and loads that object without checking which organization or trust center it belongs to. An unauthenticated internet visitor can use the Query.node(id:) call to read organization, framework, audit, subprocessor, trust center and trust center reference objects from other tenants.
first public Jul 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Probo and have at least one published Trust Center are exposed, because the flawed endpoint is the public Trust Center API. Instances without a published Trust Center, or that are already on 0.224.0 or later, are not affected according to the sources.
Not affected if no-published-trust-center, version-0.224.0-or-later
Who cares graphql, grc, probo, self-hosted
0.224.0.0.224.0 or later.Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.