CVE-2026-76080

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76080
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76080.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76080
Aliases
  • GHSA-w23w-f7v2-625w
Published
2026-11-11T18:10:59Z
Modified
2026-11-12T02:46:53Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Probo: Unauthenticated cross-tenant and hidden-item disclosure via Query.node in the public Trust Center API
Details

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284",
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76080.json"
}
References

Affected packages

Git / github.com/getprobo/probo

Affected ranges

Type
GIT
Repo
https://github.com/getprobo/probo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8bd8e486aeef8652acba3a38a0ce30a414319d2
Fixed
eb9274f2cd7101f89c21c18f6d7a3570f95aff32
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.224.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "eb9274f2cd7101f89c21c18f6d7a3570f95aff32"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@probo/cookie-banner/v0.*
@probo/cookie-banner/v0.10.0
@probo/cookie-banner/v0.3.0
@probo/cookie-banner/v0.3.1
@probo/cookie-banner/v0.4.0
@probo/cookie-banner/v0.4.1
@probo/cookie-banner/v0.5.0
@probo/cookie-banner/v0.6.0
@probo/cookie-banner/v0.7.0
@probo/cookie-banner/v0.8.0
@probo/cookie-banner/v0.9.0
@probo/cookie-banner/v0.9.1
@probo/cookie-banner/v0.9.2
@probo/cookie-banner/v0.9.3
@probo/n8n-nodes-probo/v0.*
@probo/n8n-nodes-probo/v0.182.0
@probo/n8n-nodes-probo/v0.183.0
@probo/n8n-nodes-probo/v0.184.0
@probo/n8n-nodes-probo/v0.185.0
@probo/n8n-nodes-probo/v0.186.0
@probo/n8n-nodes-probo/v0.187.0
@probo/n8n-nodes-probo/v0.187.1
@probo/n8n-nodes-probo/v0.188.0
@probo/n8n-nodes-probo/v0.189.0
@probo/n8n-nodes-probo/v0.190.0
@probo/n8n-nodes-probo/v0.191.0
@probo/n8n-nodes-probo/v0.192.0
@probo/n8n-nodes-probo/v0.193.0
@probo/n8n-nodes-probo/v0.194.0
@probo/n8n-nodes-probo/v0.195.0
@probo/n8n-nodes-probo/v0.196.0
@probo/n8n-nodes-probo/v0.197.0
@probo/n8n-nodes-probo/v0.198.0
@probo/n8n-nodes-probo/v0.199.0
@probo/n8n-nodes-probo/v0.200.0
helm/v0.*
helm/v0.1.0
helm/v0.10.0
helm/v0.2.0
helm/v0.2.1
helm/v0.3.0
helm/v0.4.0
helm/v0.5.0
helm/v0.6.0
helm/v0.7.0
helm/v0.8.0
helm/v0.9.0
helm/v0.9.1
prb/v0.*
prb/v0.182.0
prb/v0.183.0
prb/v0.183.1
prb/v0.184.0
prb/v0.185.0
prb/v0.186.0
prb/v0.187.0
prb/v0.188.0
prb/v0.189.0
prb/v0.190.0
prb/v0.191.0
prb/v0.192.0
prb/v0.193.0
prb/v0.194.0
prb/v0.195.0
prb/v0.196.0
prb/v0.197.0
prb/v0.197.1
prb/v0.198.0
prb/v0.199.0
probo-agent/v0.*
probo-agent/v0.1.0
probo-agent/v0.1.1
proboctl/v0.*
proboctl/v0.1.0
proboctl/v0.2.0
proboctl/v0.3.0
proboctl/v0.3.1
proboctl/v0.4.0
proboctl/v0.5.0
proboctl/v0.6.0
proboctl/v0.7.0
proboctl/v0.7.1
proboctl/v0.8.0
probod-bootstrap/v0.*
probod-bootstrap/v0.1.1
probod-bootstrap/v0.1.2
probod-bootstrap/v0.2.0
probod-bootstrap/v0.3.0
probod-bootstrap/v0.4.0
probod-bootstrap/v0.4.1
probod/v0.*
probod/v0.182.0
probod/v0.183.0
probod/v0.184.0
probod/v0.184.1
probod/v0.184.2
probod/v0.185.0
probod/v0.186.0
probod/v0.186.1
probod/v0.187.0
probod/v0.188.0
probod/v0.189.0
probod/v0.190.0
probod/v0.190.1
probod/v0.191.0
probod/v0.192.0
probod/v0.193.0
probod/v0.193.1
probod/v0.194.0
probod/v0.195.0
probod/v0.196.0
probod/v0.196.1
probod/v0.197.0
probod/v0.198.0
probod/v0.199.0
probod/v0.199.1
probod/v0.200.0
probod/v0.200.1
probod/v0.201.0
probod/v0.202.0
probod/v0.202.1
probod/v0.202.2
probod/v0.203.0
probod/v0.204.0
probod/v0.205.0
probod/v0.206.0
probod/v0.207.0
probod/v0.208.0
probod/v0.208.1
probod/v0.209.0
probod/v0.210.0
probod/v0.211.0
probod/v0.211.1
probod/v0.211.2
probod/v0.212.0
probod/v0.213.0
probod/v0.214.0
probod/v0.215.0
probod/v0.215.1
probod/v0.216.0
probod/v0.216.1
probod/v0.217.0
probod/v0.218.0
probod/v0.218.1
probod/v0.219.0
probod/v0.220.0
probod/v0.221.0
probod/v0.222.0
probod/v0.222.1
probod/v0.222.2
probod/v0.223.0
probod/v0.223.1
probod/v0.223.2
probod/v0.223.3
v0.*
v0.1.0
v0.10.0
v0.10.1
v0.100.0
v0.101.0
v0.101.1
v0.102.0
v0.103.0
v0.104.0
v0.105.0
v0.106.0
v0.107.0
v0.107.1
v0.108.0
v0.109.0
v0.11.0
v0.11.1
v0.110.0
v0.110.1
v0.110.2
v0.111.0
v0.111.1
v0.111.2
v0.112.0
v0.112.1
v0.112.2
v0.112.3
v0.112.4
v0.113.0
v0.114.0
v0.115.0
v0.116.0
v0.116.1
v0.116.10
v0.116.11
v0.116.12
v0.116.13
v0.116.14
v0.116.15
v0.116.2
v0.116.3
v0.116.4
v0.116.5
v0.116.6
v0.116.7
v0.116.8
v0.116.9
v0.117.0
v0.117.1
v0.117.2
v0.117.3
v0.118.0
v0.118.1
v0.118.2
v0.119.0
v0.119.1
v0.12.0
v0.120.0
v0.121.0
v0.121.1
v0.122.0
v0.123.0
v0.123.1
v0.123.2
v0.123.3
v0.124.0
v0.124.1
v0.124.2
v0.125.0
v0.125.1
v0.125.1-1
v0.125.1-2
v0.125.1-3
v0.125.1-4
v0.126.0
v0.126.1
v0.127.0
v0.127.1
v0.128.0
v0.129.0
v0.129.1
v0.129.2
v0.129.3
v0.13.0
v0.13.1
v0.13.2
v0.130.0
v0.130.1
v0.130.2
v0.130.3
v0.131.0
v0.131.1
v0.131.2
v0.132.0
v0.133.0
v0.134.0
v0.134.1
v0.134.2
v0.134.3
v0.135.0
v0.135.1
v0.136.0
v0.137.0
v0.137.1
v0.137.2
v0.137.3
v0.138.0
v0.138.1
v0.138.2
v0.139.0
v0.14.0
v0.140.0
v0.141.0
v0.142.0
v0.142.1
v0.142.2
v0.143.0
v0.144.0
v0.145.0
v0.146.0
v0.146.1
v0.147.0
v0.148.0
v0.149.0
v0.149.1
v0.15.0
v0.15.1
v0.150.0
v0.151.0
v0.152.0
v0.153.0
v0.153.1
v0.153.2
v0.154.0
v0.154.1
v0.154.2
v0.155.0
v0.156.0
v0.156.1
v0.157.0
v0.158.0
v0.159.0
v0.16.0
v0.160.0
v0.160.1
v0.160.2
v0.161.0
v0.161.1
v0.161.2
v0.162.0
v0.162.1
v0.163.0
v0.163.1
v0.163.2
v0.164.0
v0.165.0
v0.165.1
v0.165.2
v0.165.3
v0.166.0
v0.167.0
v0.168.0
v0.168.1
v0.168.2
v0.169.0
v0.169.1
v0.17.0
v0.170.0
v0.171.0
v0.171.1
v0.172.0
v0.172.1
v0.173.0
v0.174.0
v0.175.0
v0.176.0
v0.176.1
v0.177.0
v0.177.1
v0.178.0
v0.179.0
v0.179.1
v0.18.0
v0.18.1
v0.180.0
v0.181.0
v0.19.0
v0.19.1
v0.19.2
v0.2.0
v0.20.0
v0.20.1
v0.204.0
v0.21.0
v0.216.1
v0.22.0
v0.23.0
v0.23.1
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.27.1
v0.28.0
v0.29.0
v0.30.0
v0.30.1
v0.31.0
v0.32.0
v0.33.0
v0.33.1
v0.33.2
v0.33.3
v0.33.4
v0.33.5
v0.33.6
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.37.1
v0.37.2
v0.37.3
v0.37.4
v0.37.5
v0.38.0
v0.38.1
v0.39.0
v0.4.0
v0.4.1
v0.4.2
v0.40.0
v0.41.0
v0.42.0
v0.42.1
v0.43.0
v0.43.1
v0.44.0
v0.45.0
v0.45.1
v0.46.0
v0.46.1
v0.46.2
v0.47.0
v0.48.0
v0.48.1
v0.49.0
v0.5.0
v0.50.0
v0.50.1
v0.51.0
v0.51.1
v0.52.0
v0.53.0
v0.54.0
v0.55.0
v0.56.0
v0.57.0
v0.57.1
v0.58.0
v0.58.1
v0.58.2
v0.58.3
v0.58.4
v0.59.0
v0.59.1
v0.6.0
v0.60.0
v0.61.0
v0.61.1
v0.62.0
v0.63.0
v0.63.1
v0.64.0
v0.64.1
v0.65.0
v0.65.1
v0.66.0
v0.66.1
v0.67.0
v0.67.1
v0.67.2
v0.68.0
v0.68.1
v0.68.2
v0.68.3
v0.69.0
v0.7.0
v0.70.0
v0.71.0
v0.72.0
v0.73.0
v0.73.1
v0.74.0
v0.74.1
v0.74.2
v0.74.3
v0.74.4
v0.74.5
v0.74.6
v0.74.7
v0.75.0
v0.75.1
v0.76.0
v0.77.0
v0.78.0
v0.79.0
v0.8.0
v0.80.0
v0.80.1
v0.80.2
v0.81.0
v0.82.0
v0.83.0
v0.84.0
v0.85.0
v0.86.0
v0.86.1
v0.86.2
v0.86.3
v0.86.4
v0.87.0
v0.88.0
v0.88.1
v0.88.2
v0.88.3
v0.88.5
v0.88.6
v0.88.7
v0.88.8
v0.89.0
v0.89.1
v0.9.0
v0.90.0
v0.90.1
v0.91.0
v0.92.0
v0.93.0
v0.94.0
v0.94.1
v0.94.2
v0.95.0
v0.96.0
v0.96.1
v0.97.0
v0.98.0
v0.98.1
v0.99.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76080.json"