coop vulnerabilities

2 known vulnerabilities in coop from Roostorg. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  coop: Improper Authentication

  CVE-2026-63398Oct 30, 2026Roostorg

  Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgI

• 8.7 High severity

  coop: Missing Authentication for Critical Functionality

  CVE-2026-63396Oct 30, 2026Roostorg

  Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, na