Arbitrary User Access Vulnerability in Coop by ROOST
CVE-2026-63401

5.3MEDIUM

Key Information:

Vendor

Roostorg

Status
Coop
Vendor
CVE Published:
30 October 2026

What is CVE-2026-63401?

Coop, an open-source review and moderation tool from ROOST, has a vulnerability that permits authenticated users to manipulate queue access permissions improperly. Specifically, functions addAccessibleQueuesForUser and removeAccessibleQueuesForUser fail to enforce proper organizational boundaries, allowing users holding MRT queue-edit permissions to grant or remove access for users from other organizations. While this issue does not lead to the exposure of sensitive queue contents, it can potentially disrupt moderation processes by creating unauthorized access pathways. The vulnerability has been addressed in version 1.0.2.

Affected Version(s)

coop < 1.0.2

References

https://github.com/roostorg/coop/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/roostorg/coop/pull/872
x_refsource_MISC
https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f1...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.