roostorg has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 6.9 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-63396High· 8.7Coop has a data leak via unauthenticated GraphQL Query.allOrgs48CVE-2026-63398High· 7.4Coop has SAML cross-tenant authentication bypass41CVE-2026-63399Medium· 6.9Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg38CVE-2026-63401Medium· 5.3Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser29CVE-2026-63400Low· 2.3Coop sessions are not invalidated on password reset13
roostorg vulnerabilities
CVEs affecting roostorg, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-63398High· 7.4Coop has SAML cross-tenant authentication bypass
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organizatio…
CVE-2026-63396High· 8.7Coop has a data leak via unauthenticated GraphQL Query.allOrgs
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, includi…
CVE-2026-63401Medium· 5.3Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticate…
CVE-2026-63400Low· 2.3Coop sessions are not invalidated on password reset
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a sessi…
CVE-2026-63399Medium· 6.9Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition t…