Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor...
Vendor
getprobo vulnerabilities
6 published CVES affecting getprobo, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 6
- Critical
- 0
- High
- 1
- Medium
- 3
- Low
- 2
- Unscored
- 0
- CISA KEV
- 0
Products
Latest getprobo CVEs
Newest publication first
-
LowCVSS 3.7 EPSS 0.32%
-
HighCVSS 7.2 EPSS 0.45%
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has be...
-
LowCVSS 3.1 EPSS 0.18%
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes acceptElectronicSignature and recordSigningEvent, both gated only by @authentication(required:...
-
MediumCVSS 4.9 EPSS 0.64%
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via...
-
MediumCVSS 4.3 EPSS 0.35%
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request...
-
MediumCVSS 4.7 EPSS 0.42%
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links)....
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.