CVE-2026-63401

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...

CVE-2026-63401 Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...

CVE-2026-63401

The Coop open source review and moderation tool by ROOST is vulnerable to an authorization bypass (IDOR) in versions prior to 1.0.2 . The addAccessibleQueuesForUser and removeAccessibleQueuesForUser functions fail to scope queueId and userId values to the caller's organization. Consequently, an a...

EUVD-2026-114549

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...