Skip to content
OpenAdvisories

Vendor

roostorg

5 known vulnerabilities.

Products

coop 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-63401

    Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser

    Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to on…

    roostorg coop
  • Medium 6.9
    CVE-2026-63399

    Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

    Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in th…

    roostorg coop