CVE-2026-76080

Name of the Vulnerable Software and Affected Versions Probo versions prior to 0.224.0

Description The public Trust Center GraphQL API allows unauthenticated visitors to access sensitive information via the Query.node(id:) endpoint. Specifically, six type branches—Organization, Framework, Audit, ThirdParty, TrustCenter, and TrustCenterReference—resolve objects using a tenant scope derived from the client-supplied GID through the coredata.NewScopeFromObjectID(id) function. These branches use a Get(scope, id) call that fails to verify the current trust center's OrganizationID or perform visibility checks.

Recommendations Update to version 0.224.0.