Threats affecting pkg:github/roostorg/coop

CVE-2026-63400 is a low-severity vulnerability in the open source review and moderation tool Coop from ROOST. Versions prior to 1.0.2 do not invalidate existing database-backed sessions when a password is reset via the resetPasswordForToken function. This allows an attacker who has compromised a password and established a session to retain access to the account until the session expires, which can be up to 30 days. The issue is fixed in version 1.0.2.

CVE-2026-63398 is an improper authentication vulnerability in roostorg's Coop open source review and moderation tool. Versions prior to 1.0.2 use a SAML strategy that resolves authenticated users by email alone without binding to the organization, allowing an attacker who controls a SAML IdP signing key to impersonate users across organizations sharing the same signing certificate. This enables full cross-tenant account takeover without privileges in the target organization. The issue is fixed in version 1.0.2.

CVE-2026-63401 is an authorization bypass vulnerability in roostorg's open source tool Coop prior to version 1.0.2. The flaw allowed authenticated users with MRT queue-edit permission in one organization to grant or revoke manual review queue access for users in other organizations due to missing organization scoping in certain functions. No confidential data disclosure occurred as the attacker could not read other organizations' queues or jobs. The issue is fixed in version 1.0.2.

CVE-2026-63396 is a vulnerability in roostorg's Coop, an open source review and moderation tool. Versions prior to 1.0.0 allow unauthenticated actors to query the GraphQL API endpoint `/api/v1/graphql` and retrieve sensitive organizational and user data. This includes organization IDs, names, email addresses, website URLs, on-call alert emails, and detailed user information such as IDs, emails, names, roles, permissions, and creation dates. The issue is resolved in version 1.0.0.

CVE-2026-63399 is a vulnerability in roostorg's open source tool Coop prior to version 1.0.0. The GraphQL Mutation.createOrg operation allows unauthenticated users to create arbitrary organizations on publicly accessible instances. This can generate excessive log noise and, due to lack of rate limiting, may lead to database exhaustion. The issue is resolved in version 1.0.0. Running the service on an authenticated private network can mitigate exposure by preventing unauthorized external access to the GraphQL API.