CVE-2026-63401 Details
Description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.
A cross-organization insecure direct object reference (IDOR) vulnerability has been identified in Roost Coop, an open-source review and moderation tool. This issue affects versions prior to 1.0.2. The vulnerability arises in the 'addAccessibleQueuesForUser' and 'removeAccessibleQueuesForUser' functions, which accepted arbitrary 'queueId' and 'userId' values without proper organization scoping. As a result, an authenticated user with queue-edit permissions could manipulate access to manual review queues for users in other organizations. Although this vulnerability did not allow access to confidential data, it could disrupt organizational queue management.
Users can upgrade to Roost Coop version 1.0.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f187ea63a8a7bebb8c4417088 | [email protected] | Source CodeVendor |
| https://github.com/roostorg/coop/pull/872 | [email protected] | Source CodeVendor |
| https://github.com/roostorg/coop/releases/tag/1.0.2 | [email protected] | Release NotesVendor |
| https://github.com/roostorg/coop/security/advisories/GHSA-mf74-gf5j-hxr9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Roost Coop | < 1.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |