CVE-2026-63401

    Dashboard / Vulnerabilities / CVE-2026-63401

    CVE-2026-63401

    Published: 30 Oct 2026Last Modified: 4 Nov 2026

    Summary: Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser

    Details: Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.

    References: https://github.com/roostorg/coop/releases/tag/1.0.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63401.json, https://github.com/roostorg/coop/security/advisories/GHSA-mf74-gf5j-hxr9, https://nvd.nist.gov/vuln/detail/CVE-2026-63401, https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f187ea63a8a7bebb8c4417088, https://github.com/roostorg/coop/pull/872

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a6120717f19f347925e0118823e29cd5cb88fd2b

    Affected versions

    1.0.1
    1.0.0
    1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-63401 | CVE-DB