getprobo Probo up to 0.223.x Trust Center GraphQL API Query.node id comparison

Summaryinfo

A vulnerability classified as problematic was found in getprobo Probo up to 0.223.x. This affects the function Query.node of the component Trust Center GraphQL API. Such manipulation of the argument ID leads to comparison. This vulnerability is uniquely identified as CVE-2026-76080. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in getprobo Probo up to 0.223.x. It has been rated as problematic. Affected by this issue is the function Query.node of the component Trust Center GraphQL API. The manipulation of the argument id with an unknown input leads to a comparison vulnerability. Using CWE to declare the problem leads to CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect. Impacted is confidentiality. CVE summarizes:

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-76080 since 08/18/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.224.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• getprobo

Name

• Probo

Version

• 0.223

Website

• Product: https://github.com/getprobo/probo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion