Cross-Tenant Risk Exposure in Probo GRC Platform by Probo

CVE-2026-63505

What is CVE-2026-63505?

Probo, a self-hosted governance, risk, and compliance (GRC) platform, has a vulnerability in its console GraphQL API prior to version 0.223.1. The flaw stems from a failure to validate organizational ownership of risks associated with findings, which allows authenticated users from one organization to access and manipulate the risk data of another organization. Specifically, this could enable users to attach risks from their own organization to findings while viewing sensitive information regarding other organizations’ risks, such as name and severity. This improper authorization can also lead to denial-of-service issues, preventing organizations from managing their own risks effectively. The vulnerability has been addressed in version 0.223.1.

References