CVE-2026-63396 Coop has a data leak via unauthenticated GraphQL Query.allOrgs

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

CVE-2026-63399: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could...

CVE-2026-63398: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using kyselyUserFindByEmail, without binding the lookup to the organization in /saml/login/:orgId/callback. An attacker who administers ...

CVE-2026-63396: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

vavassori-roost.ch Cross Site Scripting vulnerability OBB-2356713

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...