CVE-2026-63401

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...

CVE-2026-63398

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using kyselyUserFindByEmail, without binding the lookup to the organization in /saml/login/:orgId/callback. An attacker who administers ...

CVE-2026-63400

The open-source review and moderation tool Coop by ROOST is vulnerable to insufficient session expiration. Prior to version 1.0.2 , the resetPasswordForToken function updates the password row but fails to invalidate existing database-backed sessions. This allows an attacker who has already establ...

EUVD-2026-114551

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, resetPasswordForToken updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the...

CVE-2026-63398

The Coop open source review and moderation tool (prior to version 1.0.2 ) contains a SAML strategy vulnerability in the /saml/login/:orgId/callback endpoint. The root cause is that the verify callback resolves authenticated users by email alone via kyselyUserFindByEmail without binding the lookup...

CVE-2026-63398 Coop has SAML cross-tenant authentication bypass

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using kyselyUserFindByEmail, without binding the lookup to the organization in /saml/login/:orgId/callback. An attacker who administers ...

EUVD-2026-114550

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using kyselyUserFindByEmail, without binding the lookup to the organization in /saml/login/:orgId/callback. An attacker who administers ...

CVE-2026-63401

The Coop open source review and moderation tool by ROOST is vulnerable to an authorization bypass (IDOR) in versions prior to 1.0.2 . The addAccessibleQueuesForUser and removeAccessibleQueuesForUser functions fail to scope queueId and userId values to the caller's organization. Consequently, an a...

EUVD-2026-114549

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...

CVE-2026-63401 Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...

CVE-2026-63396

The open-source review and moderation tool Coop by ROOST is vulnerable to a data leak in versions prior to 1.0.0 . An unauthenticated actor can query the Query.allOrgs field via the /api/v1/graphql endpoint on publicly accessible deployments. This flaw allows the retrieval of sensitive data for a...

CVE-2026-63396 Coop has a data leak via unauthenticated GraphQL Query.allOrgs

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

CVE-2026-63399

The open-source review and moderation tool Coop by ROOST is vulnerable to unauthenticated organization creation in versions prior to 1.0.0 . The issue resides in the GraphQL Mutation.createOrg operation, which allows an unauthenticated actor to create arbitrary organizations on publicly accessibl...

EUVD-2026-114547

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

CVE-2015-5119

CVE-2015-5119 A COOP like exploit...

CVE-2026-63398: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using kyselyUserFindByEmail, without binding the lookup to the organization in /saml/login/:orgId/callback. An attacker who administers ...

CVE-2026-63399: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

CVE-2026-63400: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, resetPasswordForToken updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the...

CVE-2026-63401: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...

CVE-2026-63396: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...