CVE-2026-76079

CVSS 7.2 (high) · published 2026-11-11

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0.

Weakness: CWE-269, CWE-863

Source: NVD CVE-2026-76079

References

• https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32
• https://github.com/getprobo/probo/pull/1475
• https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0
• https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp
• https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.