CVE-2026-76080

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76080", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-18T21:17:32.200Z", "datePublished": "2026-11-11T18:10:59.917Z", "dateUpdated": "2026-11-11T18:10:59.917Z"}, "containers": {"cna": {"title": "Probo: Unauthenticated cross-tenant and hidden-item disclosure via Query.node in the public Trust Center API", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/getprobo/probo/security/advisories/GHSA-w23w-f7v2-625w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getprobo/probo/security/advisories/GHSA-w23w-f7v2-625w"}, {"name": "https://github.com/getprobo/probo/pull/1475", "tags": ["x_refsource_MISC"], "url": "https://github.com/getprobo/probo/pull/1475"}, {"name": "https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32", "tags": ["x_refsource_MISC"], "url": "https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32"}, {"name": "https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0"}], "affected": [{"vendor": "getprobo", "product": "probo", "versions": [{"version": "< 0.224.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-11T18:10:59.917Z"}, "descriptions": [{"lang": "en", "value": "Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) \u2014 an unauthenticated internet visitor to any published trust center can call it. Six of its type branches \u2014 Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference \u2014 resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0."}], "source": {"advisory": "GHSA-w23w-f7v2-625w", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "probo", "vendor": "getprobo", "versions": [{"status": "affected", "version": "< 0.224.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) \u2014 an unauthenticated internet visitor to any published trust center can call it. Six of its type branches \u2014 Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference \u2014 resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0."}], "id": "CVE-2026-76080", "lastModified": "2026-11-11T19:17:45.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-11T19:17:44.897", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32"}, {"source": "security-advisories@github.com", "url": "https://github.com/getprobo/probo/pull/1475"}, {"source": "security-advisories@github.com", "url": "https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/getprobo/probo/security/advisories/GHSA-w23w-f7v2-625w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.224.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "probo", "source": "cna", "vendor": "getprobo"}, "product": "probo", "vendor": "getprobo"}], "created": "2026-11-12T21:15:09.127885+00:00", "updated": "2026-11-13T07:30:12.036827+00:00", "vendors": ["getprobo", "getprobo$PRODUCT$probo"]}