CVE-2026-76080: Probo: Unauthenticated cross-tenant and hidden-item disclosure via Query.node in the public Trust Center API
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Proboto a version that resolves this vulnerability.Fixed in 0.224.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running a version prior to 0.224.0 with a published Trust Center are exposed through the public Trust Center GraphQL API.
Does an attacker need an account or other privileges?
No. The affected Query.node(id:) endpoint permits optional authentication, so an unauthenticated internet visitor can invoke it.
What data can be disclosed through the affected resolver?
The affected branches can disclose Organization, Framework, Audit, ThirdParty, TrustCenter, and TrustCenterReference objects across tenants or when hidden from the Trust Center. Document and File branches apply organization and visibility checks and are not described as affected.
How can I determine whether remediation is needed?
Check the deployed Probo version and whether the instance has a published Trust Center. Versions earlier than 0.224.0 need the patch; version 0.224.0 includes the fix.