CVE-2026-63505

Name of the Vulnerable Software and Affected Versions Probo versions prior to 0.223.1

Description The console GraphQL API fails to validate that a referenced risk belongs to the caller's organization when a Finding references a Risk via finding.riskId. The Finding.risk field resolver authorizes the finding based on the caller's organization but loads the risk using a tenant scope derived from the risk's own global ID. This allows an authenticated member of one organization to attach a risk global ID from another organization to a finding they own, enabling them to read sensitive risk details including name, description, treatment, category, severity, and owner. Additionally, this cross-tenant reference can prevent the owner organization of the risk from deleting it due to a restriction on deletion, resulting in a denial of service regarding data integrity.

Recommendations Update to version 0.223.1.