CVE-2026-76078: Probo: Broken access control in public e-signature API
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes acceptElectronicSignature and recordSigningEvent, both gated only by @authentication(required: PRESENT) @sessionOnly — any self-provisioned trust center identity can call them. The underlying esign.Service.AcceptSignature and esign.Service.recordEvent build the tenant scope from the client-supplied signatureId GID (coredata.NewScopeFromObjectID(req.SignatureID)) and load the signature by that GID. At no point do they verify that the signature belongs to the caller or that the caller's email matches the signature's SignerEmail. As a result, any authenticated trust-center visitor who possesses another visitor's signature GID can: (1) complete that visitor's NDA signature — overwriting signer name/IP/UA with attacker data and setting status to Accepted, which triggers the sealing worker to generate a completion certificate; (2) inject arbitrary audit-trail events into any signature's log. Both attacks defeat the non-repudiation and integrity guarantees of the e-signature system. This issue has been patched in version 0.224.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Proboto a version that resolves this vulnerability.Fixed in 0.224.0
Event History
Frequently Asked Questions
Which deployments are affected?
Probo deployments running versions prior to 0.224.0 are affected where the public Trust Center GraphQL API is available.
What does an attacker need to exploit this issue?
An attacker needs an authenticated, self-provisioned Trust Center identity and the signature GID of another visitor's signature. No interaction from the targeted signer is required.
What can an attacker do with a known signature GID?
They can complete another visitor's NDA signature, replacing signer name, IP, and user-agent information and causing a completion certificate to be generated. They can also add arbitrary events to that signature's audit trail.