From 83cceb5d00ffa1373c0fefa56a5237f80ef61407 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Fri, 3 Jul 2026 12:14:35 +0200 Subject: [PATCH] Release probod/v0.223.1 Signed-off-by: Bryan Frimin --- cmd/probod/CHANGELOG.md | 6 ++++++ cmd/probod/VERSION | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/cmd/probod/CHANGELOG.md b/cmd/probod/CHANGELOG.md index ea138eb44..d969b092f 100644 --- a/cmd/probod/CHANGELOG.md +++ b/cmd/probod/CHANGELOG.md @@ -4,6 +4,12 @@ All notable changes to `probod` (the server, including the bundled `@probo/conso ## Unreleased +## [0.223.1] - 2026-07-03 + +### Fixed + +- Fixed a cross-tenant IDOR where a Finding's linked Risk or a Processing Activity's Data Protection Officer could disclose another organization's data (GHSA-c74x-79w6-63jh): affected resolvers now authorize the referenced object itself instead of its parent, and the write paths validate the reference against the caller's organization + ## [0.223.0] - 2026-07-02 ### Added diff --git a/cmd/probod/VERSION b/cmd/probod/VERSION index 0c71b262a..7beca673f 100644 --- a/cmd/probod/VERSION +++ b/cmd/probod/VERSION @@ -1 +1 @@ -0.223.0 +0.223.1