Skip to content
OpenAdvisories

Vendor

roostorg

5 known vulnerabilities.

Products

coop 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-63398

    Coop has SAML cross-tenant authentication bypass

    Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:org…

    roostorg coop
  • High 8.7
    CVE-2026-63396

    Coop has a data leak via unauthenticated GraphQL Query.allOrgs

    Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, n…

    roostorg coop