{"id":"CVE-2026-63505","summary":"Probo: Cross-tenant IDOR via unvalidated FK references","details":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via finding.riskId. That reference is stored without validating that the risk belongs to the caller's organization, and the Finding.risk field resolver authorizes the finding (caller's org) instead of the risk, then loads the risk with a tenant scope derived from the risk's own global ID. As a result, an authenticated member of organization A can attach an arbitrary organization B risk GID to a finding they own and then read organization B's Risk (name, description, treatment, category, severity, owner) — with no membership in B. The stored cross-tenant reference also blocks B from deleting its own risk (ON DELETE RESTRICT), a cross-tenant integrity/DoS. This issue has been patched in version 0.223.1.","aliases":["GHSA-c74x-79w6-63jh"],"modified":"2026-11-12T02:48:37.010126402Z","published":"2026-11-11T18:07:51.940Z","database_specific":{"cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63505.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63505.json"},{"type":"FIX","url":"https://github.com/getprobo/probo/commit/d03f6077ddf85ad448cbcb2145341d9543fc4711"},{"type":"WEB","url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.223.1"},{"type":"ADVISORY","url":"https://github.com/getprobo/probo/security/advisories/GHSA-c74x-79w6-63jh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63505"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/getprobo/probo","events":[{"introduced":"0"},{"fixed":"83cceb5d00ffa1373c0fefa56a5237f80ef61407"},{"fixed":"d03f6077ddf85ad448cbcb2145341d9543fc4711"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"0.223.1"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"d03f6077ddf85ad448cbcb2145341d9543fc4711"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["probod/v0.223.0","prb/v0.199.0","@probo/n8n-nodes-probo/v0.200.0","probod/v0.222.2","probod-bootstrap/v0.4.1","probod/v0.222.1","probod/v0.222.0","probod-bootstrap/v0.4.0","prb/v0.198.0","helm/v0.10.0","@probo/n8n-nodes-probo/v0.199.0","probod/v0.221.0","@probo/n8n-nodes-probo/v0.198.0","probod-bootstrap/v0.3.0","probod/v0.220.0","prb/v0.197.1","helm/v0.9.1","helm/v0.9.0","proboctl/v0.8.0","probod-bootstrap/v0.2.0","probod/v0.219.0","proboctl/v0.7.1","probod/v0.218.1","probod/v0.218.0","@probo/n8n-nodes-probo/v0.197.0","probod/v0.217.0","prb/v0.197.0","v0.216.1","probod/v0.216.1","helm/v0.8.0","probod/v0.216.0","@probo/n8n-nodes-probo/v0.196.0","probod/v0.215.1","@probo/cookie-banner/v0.10.0","proboctl/v0.7.0","probod/v0.215.0","@probo/n8n-nodes-probo/v0.195.0","probod/v0.214.0","prb/v0.196.0","proboctl/v0.6.0","probod/v0.213.0","probod/v0.212.0","probod/v0.211.2","probod/v0.211.1","proboctl/v0.5.0","probod/v0.211.0","probod/v0.210.0","prb/v0.195.0","helm/v0.7.0","@probo/cookie-banner/v0.9.3","proboctl/v0.4.0","probod/v0.209.0","probod/v0.208.1","probod-bootstrap/v0.1.2","probo-agent/v0.1.1","proboctl/v0.3.1","@probo/cookie-banner/v0.9.2","helm/v0.6.0","@probo/n8n-nodes-probo/v0.194.0","prb/v0.194.0","probod/v0.208.0","@probo/cookie-banner/v0.9.1","@probo/n8n-nodes-probo/v0.193.0","proboctl/v0.3.0","probod/v0.207.0","prb/v0.193.0","helm/v0.5.0","proboctl/v0.2.0","probod/v0.206.0","@probo/n8n-nodes-probo/v0.192.0","prb/v0.192.0","probod/v0.205.0","v0.204.0","probod/v0.204.0","helm/v0.4.0","@probo/cookie-banner/v0.9.0","probod/v0.203.0","probod/v0.202.2","probod/v0.202.1","@probo/cookie-banner/v0.8.0","probod/v0.202.0","helm/v0.3.0","@probo/n8n-nodes-probo/v0.191.0","probod/v0.201.0","prb/v0.191.0","helm/v0.2.1","probod/v0.200.1","helm/v0.2.0","probod/v0.200.0","probod/v0.199.1","probod/v0.199.0","@probo/n8n-nodes-probo/v0.190.0","probod/v0.198.0","probod/v0.197.0","probod/v0.196.1","@probo/cookie-banner/v0.7.0","probod/v0.196.0","@probo/n8n-nodes-probo/v0.189.0","prb/v0.190.0","probod/v0.195.0","probod/v0.194.0","probo-agent/v0.1.0","probod/v0.193.1","@probo/cookie-banner/v0.6.0","@probo/n8n-nodes-probo/v0.188.0","probod/v0.193.0","prb/v0.189.0","helm/v0.1.0","@probo/n8n-nodes-probo/v0.187.1","probod/v0.192.0","@probo/n8n-nodes-probo/v0.187.0","probod/v0.191.0","prb/v0.188.0","probod/v0.190.1","@probo/cookie-banner/v0.5.0","proboctl/v0.1.0","probod/v0.190.0","@probo/n8n-nodes-probo/v0.186.0","probod/v0.189.0","prb/v0.187.0","@probo/cookie-banner/v0.4.1","@probo/n8n-nodes-probo/v0.185.0","probod/v0.188.0","prb/v0.186.0","probod/v0.187.0","probod/v0.186.1","probod/v0.186.0","prb/v0.185.0","@probo/cookie-banner/v0.4.0","@probo/n8n-nodes-probo/v0.184.0","probod/v0.185.0","prb/v0.184.0","probod-bootstrap/v0.1.1","probod/v0.184.2","prb/v0.183.1","probod/v0.184.1","@probo/cookie-banner/v0.3.1","probod/v0.184.0","prb/v0.183.0","@probo/n8n-nodes-probo/v0.183.0","@probo/cookie-banner/v0.3.0","probod/v0.183.0","@probo/n8n-nodes-probo/v0.182.0","probod/v0.182.0","prb/v0.182.0","v0.181.0","v0.180.0","v0.179.1","v0.179.0","v0.178.0","v0.177.1","v0.177.0","v0.176.1","v0.176.0","v0.175.0","v0.174.0","v0.173.0","v0.172.1","v0.172.0","v0.171.1","v0.171.0","v0.170.0","v0.169.1","v0.169.0","v0.168.2","v0.168.1","v0.168.0","v0.167.0","v0.166.0","v0.165.3","v0.165.2","v0.165.1","v0.165.0","v0.164.0","v0.163.2","v0.163.1","v0.163.0","v0.162.1","v0.162.0","v0.161.2","v0.161.1","v0.161.0","v0.160.2","v0.160.1","v0.160.0","v0.159.0","v0.158.0","v0.157.0","v0.156.1","v0.156.0","v0.155.0","v0.154.2","v0.154.1","v0.154.0","v0.153.2","v0.153.1","v0.153.0","v0.152.0","v0.151.0","v0.150.0","v0.149.1","v0.149.0","v0.148.0","v0.147.0","v0.146.1","v0.146.0","v0.145.0","v0.144.0","v0.143.0","v0.142.2","v0.142.1","v0.142.0","v0.141.0","v0.140.0","v0.139.0","v0.138.2","v0.138.1","v0.138.0","v0.137.3","v0.137.2","v0.137.1","v0.137.0","v0.136.0","v0.135.1","v0.135.0","v0.134.3","v0.134.2","v0.134.1","v0.134.0","v0.133.0","v0.132.0","v0.131.2","v0.131.1","v0.131.0","v0.130.3","v0.130.2","v0.130.1","v0.130.0","v0.129.3","v0.129.2","v0.129.1","v0.129.0","v0.128.0","v0.127.1","v0.127.0","v0.126.1","v0.126.0","v0.125.1-4","v0.125.1-3","v0.125.1-2","v0.125.1-1","v0.125.1","v0.125.0","v0.124.2","v0.124.1","v0.124.0","v0.123.3","v0.123.2","v0.123.1","v0.123.0","v0.122.0","v0.121.1","v0.121.0","v0.120.0","v0.119.1","v0.119.0","v0.118.2","v0.118.1","v0.118.0","v0.117.3","v0.117.2","v0.117.1","v0.117.0","v0.116.15","v0.116.14","v0.116.13","v0.116.12","v0.116.11","v0.116.10","v0.116.9","v0.116.8","v0.116.7","v0.116.6","v0.116.5","v0.116.4","v0.116.3","v0.116.2","v0.116.1","v0.116.0","v0.115.0","v0.114.0","v0.113.0","v0.112.4","v0.112.3","v0.112.2","v0.112.1","v0.112.0","v0.111.2","v0.111.1","v0.111.0","v0.110.2","v0.110.1","v0.110.0","v0.109.0","v0.108.0","v0.107.1","v0.107.0","v0.106.0","v0.105.0","v0.104.0","v0.103.0","v0.102.0","v0.101.1","v0.101.0","v0.100.0","v0.99.0","v0.98.1","v0.98.0","v0.97.0","v0.96.1","v0.96.0","v0.95.0","v0.94.2","v0.94.1","v0.94.0","v0.93.0","v0.92.0","v0.91.0","v0.90.1","v0.90.0","v0.89.1","v0.89.0","v0.88.8","v0.88.7","v0.88.6","v0.88.5","v0.88.3","v0.88.2","v0.88.1","v0.88.0","v0.87.0","v0.86.4","v0.86.3","v0.86.2","v0.86.1","v0.86.0","v0.85.0","v0.84.0","v0.83.0","v0.82.0","v0.81.0","v0.80.2","v0.80.1","v0.80.0","v0.79.0","v0.78.0","v0.77.0","v0.76.0","v0.75.1","v0.75.0","v0.74.7","v0.74.6","v0.74.5","v0.74.4","v0.74.3","v0.74.2","v0.74.1","v0.74.0","v0.73.1","v0.73.0","v0.72.0","v0.71.0","v0.70.0","v0.69.0","v0.68.3","v0.68.2","v0.68.1","v0.68.0","v0.67.2","v0.67.1","v0.67.0","v0.66.1","v0.66.0","v0.65.1","v0.65.0","v0.64.1","v0.64.0","v0.63.1","v0.63.0","v0.62.0","v0.61.1","v0.61.0","v0.60.0","v0.59.1","v0.59.0","v0.58.4","v0.58.3","v0.58.2","v0.58.1","v0.58.0","v0.57.1","v0.57.0","v0.56.0","v0.55.0","v0.54.0","v0.53.0","v0.52.0","v0.51.1","v0.51.0","v0.50.1","v0.50.0","v0.49.0","v0.48.1","v0.48.0","v0.47.0","v0.46.2","v0.46.1","v0.46.0","v0.45.1","v0.45.0","v0.44.0","v0.43.1","v0.43.0","v0.42.1","v0.42.0","v0.41.0","v0.40.0","v0.39.0","v0.38.1","v0.38.0","v0.37.5","v0.37.4","v0.37.3","v0.37.2","v0.37.1","v0.37.0","v0.36.0","v0.35.0","v0.34.0","v0.33.6","v0.33.5","v0.33.4","v0.33.3","v0.33.2","v0.33.1","v0.33.0","v0.32.0","v0.31.0","v0.30.1","v0.30.0","v0.29.0","v0.28.0","v0.27.1","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.1","v0.23.0","v0.22.0","v0.21.0","v0.20.1","v0.20.0","v0.19.2","v0.19.1","v0.19.0","v0.18.1","v0.18.0","v0.17.0","v0.16.0","v0.15.1","v0.15.0","v0.14.0","v0.13.2","v0.13.1","v0.13.0","v0.12.0","v0.11.1","v0.11.0","v0.10.1","v0.10.0","v0.9.0","v0.8.0","v0.7.0","v0.6.0","v0.5.0","v0.4.2","v0.4.1","v0.4.0","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63505.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"}]}