{"affected":[{"product":"probo","source":"CNA: GitHub_M","vendor":"getprobo","versions":[{"status":"affected","version":"< 0.224.0"}]}],"cveId":"CVE-2026-76079","cwes":["CWE-269","CWE-863"],"description":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.2,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794420593469,"publishedAt":1794420593469,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/getprobo/probo/pull/1475"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0"}],"remediation":[],"revision":"3b49e8ac73ebb1a7c5e9c61bfa54d58bb40fcbf93708f028fbf3954d0135df89","sources":[{"modifiedAt":1794420593469,"name":"CNA: GitHub_M","retrievedAt":1794424166982,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76079"}],"ssvc":null,"status":"published","title":"Probo: Vertical privilege escalation","updatedAt":1794424166982}