CVE-2026-63505: Probo: Cross-tenant IDOR via unvalidated FK references
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via finding.riskId. That reference is stored without validating that the risk belongs to the caller's organization, and the Finding.risk field resolver authorizes the finding (caller's org) instead of the risk, then loads the risk with a tenant scope derived from the risk's own global ID. As a result, an authenticated member of organization A can attach an arbitrary organization B risk GID to a finding they own and then read organization B's Risk (name, description, treatment, category, severity, owner) — with no membership in B. The stored cross-tenant reference also blocks B from deleting its own risk (ON DELETE RESTRICT), a cross-tenant integrity/DoS. This issue has been patched in version 0.223.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Proboto a version that resolves this vulnerability.Fixed in 0.223.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated member of one organization can exploit it against risks belonging to another organization. The attacker needs permission to create or modify a Finding in their own organization and needs an arbitrary target Risk global ID from the other organization.
Are default multi-tenant deployments affected?
Affected Probo versions prior to 0.223.1 are impacted where the console GraphQL API allows a Finding to reference a Risk through finding.riskId. The issue arises because the referenced Risk's organization is not validated when that reference is stored.
What information and impact can result from exploitation?
The attacker can read the target organization's Risk name, description, treatment, category, severity, and owner. A stored cross-tenant reference can also prevent the target organization from deleting that Risk because of the ON DELETE RESTRICT constraint.
How can administrators determine whether they may already be affected?
Review Findings for riskId references that point to Risks owned by a different organization. Such cross-tenant references indicate exposure and may also identify Risks whose deletion is blocked.
What is the remediation?
Upgrade Probo to version 0.223.1, which patches the issue. If upgrading cannot happen immediately, identify and remove or correct cross-tenant Finding-to-Risk references and restrict untrusted users' ability to create or modify Findings where possible.