CVE-2026-76078

Name of the Vulnerable Software and Affected Versions Probo versions prior to 0.224.0

Description The public Trust Center GraphQL API exposes the acceptElectronicSignature and recordSigningEvent endpoints. These endpoints are only protected by authentication and session requirements, allowing any self-provisioned trust center identity to access them. The underlying esign.Service.AcceptSignature and esign.Service.recordEvent functions use a client-supplied signatureId GID to load the signature without verifying if the signature belongs to the caller or if the caller's email matches the SignerEmail. Consequently, an authenticated visitor with another visitor's signature GID can complete an NDA signature by overwriting signer details and setting the status to Accepted, or inject arbitrary audit-trail events into a signature's log, compromising the non-repudiation and integrity of the e-signature system.

Recommendations Update to version 0.224.0.