Live › vulnerability › CVE-2026-63401
Coop, an open source review and moderation tool from ROOST, let a user with queue-edit permission in one organization grant or revoke queue access for users in another organization. The attacker cannot read the other organization's queues or jobs, so the impact is unauthorized changes to who can review content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Teams running Coop before version 1.0.2 with more than one organization on the same deployment, where some users hold MRT queue-edit permission. Single-organization deployments or those already on 1.0.2 are not affected by the cross-organization part, according to the description.
No product ranges from the sources yet.
1.0.2 are affected.1.0.2 or later, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-63401")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.