Is CVE-2026-63505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63505 being exploited in the wild.

How severe is CVE-2026-63505?

Medium severity, with a CVSS score of 4.9, published 11 November 2026.

How is CVE-2026-63505 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63505?

Check whether you run Probo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63505: Probo console cross-tenant insecure direct object reference in GraphQL

CVE-2026-63505 · Severity: medium · CVSS 4.9 · Published 2026-11-11

Probo is a compliance and governance platform that organizes data by customer organization. An authenticated user in one organization could attach another organization's risk or compliance officer profile to their own data record and then read that cross-organization information—such as risk descriptions, severity, or employee contact details—despite having no membership in the other organization. This data exposure is combined with a denial-of-service flaw where attackers could prevent organizations from deleting their own risks.

Technologies: Probo. Vendors: Probo.

Quick answers

Is CVE-2026-63505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63505 being exploited in the wild.
How severe is CVE-2026-63505?: Medium severity, with a CVSS score of 4.9, published 11 November 2026.
Which products and versions are affected?: Probo prior to 0.223.1.
Is there a fix for CVE-2026-63505?: Yes: fixed in 0.223.1. Until then: Restrict GraphQL API access to trusted networks or require additional authentication factors until upgrading to version 0.223.1. Disable or limit the affected Finding.risk and ProcessingActivity.dataProtectionOfficer resolvers if possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63505 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63505?: Check whether you run Probo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.223.1

Restrict GraphQL API access to trusted networks or require additional authentication factors until upgrading to version 0.223.1. Disable or limit the affected Finding.risk and ProcessingActivity.dataProtectionOfficer resolvers if possible.

Technical details

The GraphQL API resolvers for Finding.risk and ProcessingActivity.dataProtectionOfficer authorized the parent object (Finding or ProcessingActivity) against the caller's organization, then resolved the related object using the tenant scope extracted from that related object's global ID. An authenticated attacker could attach an arbitrary organization's Risk GID to a Finding they own, then query the Finding.risk field to read Risk properties scoped to the target organization. This requires authentication and organization membership but no authorization checks on the stored cross-tenant reference. A fix is available in version 0.223.1.

Affected products

Probo Probo prior to 0.223.1

Timeline

2026-07-03: disclosed
2026-07-03: patched
2026-11-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.