Search
Find a vulnerability
Search criteria
10 vulnerabilities found for coop by roostorg
CVE-2026-63401 (GCVE-0-2026-63401)
Vulnerability from nvd – Published: 2026-10-30 22:43 – Updated: 2026-11-02 14:49
VLAI
EPSS
VEX
Title
Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:48 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/872 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/bd8fc6cc5… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:48:56.177801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:49:10.279Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization\u0027s users\u0027 access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller\u0027s organization. The attacker could not read the other organization\u0027s queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:43:31.969Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-mf74-gf5j-hxr9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-mf74-gf5j-hxr9"
},
{
"name": "https://github.com/roostorg/coop/pull/872",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/872"
},
{
"name": "https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f187ea63a8a7bebb8c4417088",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f187ea63a8a7bebb8c4417088"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
}
],
"source": {
"advisory": "GHSA-mf74-gf5j-hxr9",
"discovery": "UNKNOWN"
},
"title": "Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63401",
"datePublished": "2026-10-30T22:43:31.969Z",
"dateReserved": "2026-07-16T19:20:28.987Z",
"dateUpdated": "2026-11-02T14:49:10.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63400 (GCVE-0-2026-63400)
Vulnerability from nvd – Published: 2026-10-30 22:46 – Updated: 2026-10-30 22:46
VLAI
EPSS
VEX
Title
Coop sessions are not invalidated on password reset
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.
Severity
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/778 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/f226db0fb… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.2 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:46:10.154Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2"
},
{
"name": "https://github.com/roostorg/coop/pull/778",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/778"
},
{
"name": "https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
}
],
"source": {
"advisory": "GHSA-g5xq-67g7-36r2",
"discovery": "UNKNOWN"
},
"title": "Coop sessions are not invalidated on password reset"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63400",
"datePublished": "2026-10-30T22:46:10.154Z",
"dateReserved": "2026-07-16T19:20:28.987Z",
"dateUpdated": "2026-10-30T22:46:10.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63399 (GCVE-0-2026-63399)
Vulnerability from nvd – Published: 2026-10-30 22:40 – Updated: 2026-10-30 22:40
VLAI
EPSS
VEX
Title
Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
Severity
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/699 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/b29242f12… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "CWE-799: Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:40:29.297Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475"
},
{
"name": "https://github.com/roostorg/coop/pull/699",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/699"
},
{
"name": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.0"
}
],
"source": {
"advisory": "GHSA-jcph-g6qv-g475",
"discovery": "UNKNOWN"
},
"title": "Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63399",
"datePublished": "2026-10-30T22:40:29.297Z",
"dateReserved": "2026-07-16T19:20:28.987Z",
"dateUpdated": "2026-10-30T22:40:29.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63398 (GCVE-0-2026-63398)
Vulnerability from nvd – Published: 2026-10-30 22:44 – Updated: 2026-11-02 17:56
VLAI
EPSS
VEX
Title
Coop has SAML cross-tenant authentication bypass
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:09 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/783 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/d1be81b6b… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:34.942380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:56:56.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy\u0027s verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization\u0027s callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:44:43.092Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2"
},
{
"name": "https://github.com/roostorg/coop/pull/783",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/783"
},
{
"name": "https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
}
],
"source": {
"advisory": "GHSA-2v93-383c-9fw2",
"discovery": "UNKNOWN"
},
"title": "Coop has SAML cross-tenant authentication bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63398",
"datePublished": "2026-10-30T22:44:43.092Z",
"dateReserved": "2026-07-16T19:20:28.986Z",
"dateUpdated": "2026-11-02T17:56:56.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63396 (GCVE-0-2026-63396)
Vulnerability from nvd – Published: 2026-10-30 22:42 – Updated: 2026-11-02 17:57
VLAI
EPSS
VEX
Title
Coop has a data leak via unauthenticated GraphQL Query.allOrgs
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:12 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/699 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/b29242f12… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:12:42.782789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:57:28.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users\u0027 IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:42:12.245Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4"
},
{
"name": "https://github.com/roostorg/coop/pull/699",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/699"
},
{
"name": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.0"
}
],
"source": {
"advisory": "GHSA-gv85-m34f-27g4",
"discovery": "UNKNOWN"
},
"title": "Coop has a data leak via unauthenticated GraphQL Query.allOrgs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63396",
"datePublished": "2026-10-30T22:42:12.245Z",
"dateReserved": "2026-07-16T17:39:30.172Z",
"dateUpdated": "2026-11-02T17:57:28.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63400 (GCVE-0-2026-63400)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:46 – Updated: 2026-10-30 22:46
VLAI
EPSS
VEX
Title
Coop sessions are not invalidated on password reset
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.
Severity
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/778 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/f226db0fb… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.2 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:46:10.154Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2"
},
{
"name": "https://github.com/roostorg/coop/pull/778",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/778"
},
{
"name": "https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
}
],
"source": {
"advisory": "GHSA-g5xq-67g7-36r2",
"discovery": "UNKNOWN"
},
"title": "Coop sessions are not invalidated on password reset"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63400",
"datePublished": "2026-10-30T22:46:10.154Z",
"dateReserved": "2026-07-16T19:20:28.987Z",
"dateUpdated": "2026-10-30T22:46:10.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63398 (GCVE-0-2026-63398)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:44 – Updated: 2026-11-02 17:56
VLAI
EPSS
VEX
Title
Coop has SAML cross-tenant authentication bypass
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:09 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/783 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/d1be81b6b… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:34.942380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:56:56.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy\u0027s verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization\u0027s callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:44:43.092Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2"
},
{
"name": "https://github.com/roostorg/coop/pull/783",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/783"
},
{
"name": "https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
}
],
"source": {
"advisory": "GHSA-2v93-383c-9fw2",
"discovery": "UNKNOWN"
},
"title": "Coop has SAML cross-tenant authentication bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63398",
"datePublished": "2026-10-30T22:44:43.092Z",
"dateReserved": "2026-07-16T19:20:28.986Z",
"dateUpdated": "2026-11-02T17:56:56.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63401 (GCVE-0-2026-63401)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:43 – Updated: 2026-11-02 14:49
VLAI
EPSS
VEX
Title
Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:48 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/872 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/bd8fc6cc5… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:48:56.177801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:49:10.279Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization\u0027s users\u0027 access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller\u0027s organization. The attacker could not read the other organization\u0027s queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:43:31.969Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-mf74-gf5j-hxr9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-mf74-gf5j-hxr9"
},
{
"name": "https://github.com/roostorg/coop/pull/872",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/872"
},
{
"name": "https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f187ea63a8a7bebb8c4417088",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f187ea63a8a7bebb8c4417088"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
}
],
"source": {
"advisory": "GHSA-mf74-gf5j-hxr9",
"discovery": "UNKNOWN"
},
"title": "Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63401",
"datePublished": "2026-10-30T22:43:31.969Z",
"dateReserved": "2026-07-16T19:20:28.987Z",
"dateUpdated": "2026-11-02T14:49:10.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63396 (GCVE-0-2026-63396)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:42 – Updated: 2026-11-02 17:57
VLAI
EPSS
VEX
Title
Coop has a data leak via unauthenticated GraphQL Query.allOrgs
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:12 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/699 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/b29242f12… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:12:42.782789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:57:28.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users\u0027 IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:42:12.245Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4"
},
{
"name": "https://github.com/roostorg/coop/pull/699",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/699"
},
{
"name": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.0"
}
],
"source": {
"advisory": "GHSA-gv85-m34f-27g4",
"discovery": "UNKNOWN"
},
"title": "Coop has a data leak via unauthenticated GraphQL Query.allOrgs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63396",
"datePublished": "2026-10-30T22:42:12.245Z",
"dateReserved": "2026-07-16T17:39:30.172Z",
"dateUpdated": "2026-11-02T17:57:28.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63399 (GCVE-0-2026-63399)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:40 – Updated: 2026-10-30 22:40
VLAI
EPSS
VEX
Title
Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
Severity
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/roostorg/coop/security/advisor… | x_refsource_CONFIRM |
| https://github.com/roostorg/coop/pull/699 | x_refsource_MISC |
| https://github.com/roostorg/coop/commit/b29242f12… | x_refsource_MISC |
| https://github.com/roostorg/coop/releases/tag/1.0.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "CWE-799: Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:40:29.297Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475"
},
{
"name": "https://github.com/roostorg/coop/pull/699",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/699"
},
{
"name": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.0"
}
],
"source": {
"advisory": "GHSA-jcph-g6qv-g475",
"discovery": "UNKNOWN"
},
"title": "Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63399",
"datePublished": "2026-10-30T22:40:29.297Z",
"dateReserved": "2026-07-16T19:20:28.987Z",
"dateUpdated": "2026-10-30T22:40:29.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}