CVE-2026-76079: Probo: Vertical privilege escalation

Published Nov 11, 2026

Updated

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Probo to a version that resolves this vulnerability.
Fixed in 0.224.0

Event History

Nov 11, 2026

CVE Published

via MITRE·06:09 PM

Data Sourced

via MITRE·06:09 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated organization ADMIN can exploit it. The attacker needs access to the createUser functionality and can then create an OWNER membership.

Are deployments running the fixed release affected?

No. The issue is patched in Probo version 0.224.0; versions prior to 0.224.0 are affected.

How can I determine whether an organization may have been affected?

Review organization membership creation activity for OWNER memberships created through createUser, particularly where the actor held an ADMIN role rather than an OWNER role.