{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/probo--0.222.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Probo (\u003c= 0.222.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Probo"],"content_html":"\u003cp\u003eProbo version 0.222.2 and earlier contains an Insecure Direct Object Reference (IDOR) vulnerability, tracked as CVE-2026-63505. The flaw exists because the Finding and Risk data resolvers fail to enforce tenant-scoped validation when referencing Risk IDs during the creation or update of Findings. Specifically, the system authorizes the parent Finding, but the dataloader uses the GID of the Risk object itself to scope the retrieval, effectively bypassing multi-tenancy isolation. An attacker belonging to one organization can reference a Risk ID belonging to a different organization, resulting in unauthorized cross-tenant data access. This vulnerability was disclosed alongside a PoC demonstrating the ability to read sensitive, cross-tenant risk data. The issue is resolved in Probo version 0.223.1.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to a legitimate tenant account in the target Probo instance.\u003c/li\u003e\n\u003cli\u003eAttacker enumerates or identifies a target Risk ID belonging to a different tenant.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a POST/PUT request to the FindingService API endpoint responsible for creation or updates.\u003c/li\u003e\n\u003cli\u003eAttacker includes the target Risk ID (from a different tenant) within the 'riskId' parameter of the API request.\u003c/li\u003e\n\u003cli\u003eThe application performs a server-side store operation without validating if the provided Risk ID belongs to the current user's tenant.\u003c/li\u003e\n\u003cli\u003eThe application later triggers a read operation for the Finding via the audit_resolvers.\u003c/li\u003e\n\u003cli\u003eThe application's dataloader incorrectly scopes the retrieval by the Risk object's own GID rather than the user's tenant.\u003c/li\u003e\n\u003cli\u003eThe application discloses the confidential data associated with the cross-tenant Risk object to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized retrieval of sensitive and confidential risk data across different organizational tenants. This leads to the compromise of data integrity and confidentiality for any user of a multi-tenant Probo deployment. The severity is high for platforms hosting multiple distinct organizations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the upgrade of all Probo instances to version 0.223.1 or later to remediate CVE-2026-63505. Implement monitoring for API requests targeting the 'FindingService' where the 'riskId' parameter is supplied by the user. Ensure that internal data access layers enforce mandatory tenant-scope checks that cannot be overridden by object-specific GID lookups.\u003c/p\u003e\n","date_modified":"2026-08-17T14:53:37Z","date_published":"2026-08-17T14:53:37Z","id":"https://feed.craftedsignal.io/briefs/2026-08-probo-idor/","summary":"Probo versions 0.222.2 and earlier are vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) flaw allowing unauthorized retrieval of confidential risk information due to missing tenant scoping.","title":"Probo Cross-Tenant IDOR Vulnerability (CVE-2026-63505)","url":"https://feed.craftedsignal.io/briefs/2026-08-probo-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Probo (\u003c= 0.222.2)","version":"https://jsonfeed.org/version/1.1"}