Vulnerability in Probo Governance, Risk, and Compliance Platform Exposes E-Signature Functions

CVE-2026-76078

What is CVE-2026-76078?

The Probo Governance, Risk, and Compliance (GRC) platform features a Trust Center GraphQL API that, prior to version 0.224.0, improperly restricts access to critical e-signature functionalities. Specifically, the API allows any authenticated user with a valid signature ID to manipulate signature statuses and inject arbitrary audit trail events, undermining the validity and integrity of e-signatures. This occurs due to the failure to verify the ownership of the signature against the caller's identity. An attacker could leverage this vulnerability to overwrite another user's signature with malicious data or alter signatures’ associated logs, ultimately compromising trust and non-repudiation principles integral to e-signatures. Users are advised to upgrade to version 0.224.0 or later to mitigate this vulnerability.

References