From 119b20bfbc8487332e3258cd57fcdee90787c415 Mon Sep 17 00:00:00 2001 From: Sacha Al Himdani Date: Fri, 3 Jul 2026 17:45:53 +0200 Subject: [PATCH] Release probod/v0.223.2 Signed-off-by: Sacha Al Himdani --- cmd/probod/CHANGELOG.md | 6 ++++++ cmd/probod/VERSION | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/cmd/probod/CHANGELOG.md b/cmd/probod/CHANGELOG.md index d969b092f..988d2a1a0 100644 --- a/cmd/probod/CHANGELOG.md +++ b/cmd/probod/CHANGELOG.md @@ -4,6 +4,12 @@ All notable changes to `probod` (the server, including the bundled `@probo/conso ## Unreleased +## [0.223.2] - 2026-07-03 + +### Fixed + +- Fixed a privilege-escalation gap where an organization ADMIN could mint an OWNER membership through `createUser`, bypassing the owner-only authorization enforced elsewhere; `createUser` (both the API resolver and the MCP `CreateUserTool`) now requires set-owner authorization when the requested role is OWNER + ## [0.223.1] - 2026-07-03 ### Fixed diff --git a/cmd/probod/VERSION b/cmd/probod/VERSION index 7beca673f..8f2031b67 100644 --- a/cmd/probod/VERSION +++ b/cmd/probod/VERSION @@ -1 +1 @@ -0.223.1 +0.223.2