{"id":"CVE-2026-76080","kind":"vulnerability","aliases":["CVE-2026-76080"],"related":[],"title":"Probo: unauthenticated visitors can read other tenants' GRC records via GraphQL","description":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.","summary":"Probo is a self-hosted governance, risk and compliance platform whose public Trust Center GraphQL API accepts a client-supplied object ID and loads that object without checking which organization or trust center it belongs to. An unauthenticated internet visitor can use the Query.node(id:) call to read organization, framework, audit, subprocessor, trust center and trust center reference objects from other tenants.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Probo","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["graphql","grc","other","probo","self-hosted"],"not_affected_if":["no-published-trust-center","version-0.224.0-or-later"],"how_to_check":"- Check the installed Probo version; affected versions are those before `0.224.0`.\n- Look for a published Trust Center on your Probo instance; the sources do not say whether unpublished trust centers are exposed.","fix":"- Probo: upgrade to `0.224.0` or later.","status":"open","published_at":"2026-11-11T19:17:44+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","triaged_at":"2026-11-11T19:30:46+00:00","updated_at":"2026-11-11T19:30:46+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T19:30:46Z","model":"claude-haiku-5-5","output":{"fix":"- Probo: upgrade to `0.224.0` or later.","reach":"internet","title":"Probo: unauthenticated visitors can read other tenants' GRC records via GraphQL","impact":"medium","summary":"Probo is a self-hosted governance, risk and compliance platform whose public Trust Center GraphQL API accepts a client-supplied object ID and loads that object without checking which organization or trust center it belongs to. An unauthenticated internet visitor can use the Query.node(id:) call to read organization, framework, audit, subprocessor, trust center and trust center reference objects from other tenants.","audience":"businesses","category":"other","nicknames":[],"who_cares":["probo","self-hosted","grc","graphql"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated visitors read other tenants' compliance records and subprocessor data.","analyst_note":"","how_to_check":"- Check the installed Probo version; affected versions are those before `0.224.0`.\n- Look for a published Trust Center on your Probo instance; the sources do not say whether unpublished trust centers are exposed.","plain_action":"","product_name":"Probo","needs_analyst":false,"not_affected_if":["version-0.224.0-or-later","no-published-trust-center"],"who_is_affected":"Teams that self-host Probo and have at least one published Trust Center are exposed, because the flawed endpoint is the public Trust Center API. Instances without a published Trust Center, or that are already on `0.224.0` or later, are not affected according to the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001127,"input_tokens":4805,"output_tokens":1293,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-76080':14A,17A '0.224.0':111C,211C 'accept':43B 'api':42B,117C 'audit':78B,144C 'authent':122C 'bare':172C 'belong':62B 'branch':141C,195C 'built':102C 'call':73B,135C 'center':40B,60B,81B,84B,115C,133C,184C 'check':55B,190C,202C 'client':46B,161C 'client-suppli':45B,160C 'comparison':179C 'complianc':35B,99C 'contrast':197C 'coredata.newscopefromobjectid':165C 'correct':198C 'current':182C 'cve':12A,15A 'deriv':157C 'document':192C 'engin':104C 'expos':118C 'file':194C 'framework':77B,143C 'get':173C 'gid':163C 'govern':32B,96C 'graphql':11A,19B,41B,116C 'grc':8A,20B,100C 'host':25B,31B 'hostabl':95C 'id':49B,72B,120C,166C,175C 'internet':66B,127C 'issu':205C 'load':51B,168C 'object':48B,53B,86B,152C 'option':124C 'organ':57B,76B,142C 'organizationid':186C 'pass':199C 'patch':208C 'perform':177C 'platform':36B,101C 'prior':108C 'probo':1A,18A,22B,26B,90C 'public':38B,113C 'publish':131C 'query.node':71B,119C 'read':5A,75B 'record':9A 'refer':85B 'requir':123C 'resolv':150C 'risk':33B,97C 'scope':156C,174C 'secur':106C 'self':24B,30B,94C 'self-host':23B,29B,93C 'showontrustcenter/visibility':189C 'six':137C 'subprocessor':79B,146C 'suppli':47B,162C 'team':107C 'tenant':7A,89B,155C 'thirdparti':145C 'trust':39B,59B,80B,83B,114C,132C,183C 'trustcent':147C 'trustcenter.organizationid':200C 'trustcenterrefer':149C 'type':140C 'unauthent':2A,65B,126C 'use':69B 'version':110C,210C 'via':10A 'visibl':203C 'visitor':3A,67B,128C 'whose':37B 'without':54B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Probo and have at least one published Trust Center are exposed, because the flawed endpoint is the public Trust Center API. Instances without a published Trust Center, or that are already on `0.224.0` or later, are not affected according to the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["probo"],"ptokens":["probo"],"labels":["graphql","grc","low","other","probo","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-76080':14A,17A 'cve':12A,15A 'graphql':11A 'grc':8A 'probo':1A,18A 'read':5A 'record':9A 'tenant':7A 'unauthent':2A 'via':10A 'visitor':3A","search_b":"'accept':43B 'api':42B 'audit':78B 'belong':62B 'call':73B 'center':40B,60B,81B,84B 'check':55B 'client':46B 'client-suppli':45B 'complianc':35B 'framework':77B 'govern':32B 'graphql':19B,41B 'grc':20B 'host':25B,31B 'id':49B,72B 'internet':66B 'load':51B 'object':48B,53B,86B 'organ':57B,76B 'platform':36B 'probo':22B,26B 'public':38B 'query.node':71B 'read':75B 'refer':85B 'risk':33B 'self':24B,30B 'self-host':23B,29B 'subprocessor':79B 'suppli':47B 'tenant':89B 'trust':39B,59B,80B,83B 'unauthent':65B 'use':69B 'visitor':67B 'whose':37B 'without':54B","search_c":"'0.224.0':111C,211C 'api':117C 'audit':144C 'authent':122C 'bare':172C 'branch':141C,195C 'built':102C 'call':135C 'center':115C,133C,184C 'check':190C,202C 'client':161C 'client-suppli':160C 'comparison':179C 'complianc':99C 'contrast':197C 'coredata.newscopefromobjectid':165C 'correct':198C 'current':182C 'deriv':157C 'document':192C 'engin':104C 'expos':118C 'file':194C 'framework':143C 'get':173C 'gid':163C 'govern':96C 'graphql':116C 'grc':100C 'hostabl':95C 'id':120C,166C,175C 'internet':127C 'issu':205C 'load':168C 'object':152C 'option':124C 'organ':142C 'organizationid':186C 'pass':199C 'patch':208C 'perform':177C 'platform':101C 'prior':108C 'probo':90C 'public':113C 'publish':131C 'query.node':119C 'requir':123C 'resolv':150C 'risk':97C 'scope':156C,174C 'secur':106C 'self':94C 'self-host':93C 'showontrustcenter/visibility':189C 'six':137C 'subprocessor':146C 'suppli':162C 'team':107C 'tenant':155C 'thirdparti':145C 'trust':114C,132C,183C 'trustcent':147C 'trustcenter.organizationid':200C 'trustcenterrefer':149C 'type':140C 'unauthent':126C 'version':110C,210C 'visibl':203C 'visitor':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-09T10:19:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76080","severity":null,"published_at":"2026-11-11T19:17:44+00:00","modified_at":"2026-11-11T19:17:45+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","fetched_at":"2026-11-11T19:28:48+00:00","note":null}],"documents":[{"id":128156,"url":"https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128158,"url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128167,"url":"https://github.com/getprobo/probo/security/advisories/GHSA-w23w-f7v2-625w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-09T10:19:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}