GHSA-cppp-g98f-gfpp: Probo: Vertical privilege escalation

Published Nov 11, 2026

Updated

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Probo to a version that resolves this vulnerability.
Fixed in 0.224.0

Event History

Nov 11, 2026

CVE Published

via OSV·06:09 PM

Data Sourced

via OSV·06:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with organization ADMIN privileges can exploit it. No user interaction is required.

What access can an attacker gain?

The attacker can create an OWNER membership, elevating from organization ADMIN to OWNER and bypassing the owner-only authorization check for assigning owner status.

Which Probo versions are affected?

Versions before 0.224.0 are affected. The issue is patched in version 0.224.0.

What should teams do to remediate the issue?

Upgrade Probo to version 0.224.0. Review organization memberships for unexpected OWNER accounts, particularly where an ADMIN may have created or modified user memberships.

GHSA-cppp-g98f-gfpp: Probo: Vertical privilege escalation

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

Which Probo versions are affected?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

Which Probo versions are affected?

What should teams do to remediate the issue?