Cross‑Tenant IDOR in Probo 0.222.2 (CVE‑2026‑63505) Exposes Data Across Tenants
What Happened — A new IDOR (Insecure Direct Object Reference) vulnerability (CVE‑2026‑63505) was disclosed for Probo ≤ 0.222.2. The flaw allows a malicious tenant to read or write data belonging to another tenant by bypassing tenant‑scoped checks in the Finding → Risk relationship. A proof‑of‑concept PoC demonstrates cross‑tenant reads without network interaction.
Why It Matters for Compliance & Audit Readiness
- The issue is a textbook example of a broken access‑control failure, directly addressed by SOC 2 CC6.1 (Logical Access) and CC6.2 (Segregation of Duties).
- Continuous‑compliance programs must capture evidence that tenant‑scoped validation is enforced at both write and read layers; this vulnerability shows why automated control monitoring is essential.
- Mapping the gap to your SOC 2 readiness checklist helps prove due diligence to auditors and reduces the risk of data‑exposure findings.
Who Is Affected — SaaS platforms, multi‑tenant web applications, and any service built on the Probo framework (primarily technology and SaaS providers).
Recommended Actions
- Upgrade to Probo 0.223.1 or later, where the IDOR is patched.
- Review and harden tenant‑scoping logic in all data‑access paths; add automated tests that validate cross‑tenant isolation.
- Capture remediation steps and test results as audit evidence for SOC 2 access‑control criteria.
Technical Notes
- Attack vector: Exploitation of missing tenant‑scoped validation in
FindingService.Create/Update(write) andfindingResolver.Risk(read). - CVE: CVE‑2026‑63505 (CVSS ≈ 7.5 High).
- Affected component: Probo core data layer, Go implementation, multiple platforms (Linux).
- PoC: Local Go test harness; no network payload, but demonstrates data leakage across tenants.
Source: Exploit‑DB #52650