https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 02 Nov 2026 23:11:32 +0000 https://db.gcve.eu/vuln/cve-2026-63401 <p><strong>Affected:</strong> roostorg coop</p> <p>Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization&#39;s users&#39; access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller&#39;s organization. The attacker could not read the other organization&#39;s queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.</p> <p><strong>Affected:</strong> roostorg coop</p> <p>Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization&#39;s users&#39; access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller&#39;s organization. The attacker could not read the other organization&#39;s queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.</p> https://db.gcve.eu/vuln/cve-2026-63401