coop vulnerabilities
CVEs whose affected-version data names the coop package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-63398High· 7.4Coop has SAML cross-tenant authentication bypass
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organizatio…
CVE-2026-63396High· 8.7Coop has a data leak via unauthenticated GraphQL Query.allOrgs
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, includi…
CVE-2026-63401Medium· 5.3Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticate…
CVE-2026-63400Low· 2.3Coop sessions are not invalidated on password reset
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a sessi…
CVE-2026-63399Medium· 6.9Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition t…