Coop
Monthly
Cross-tenant account takeover in ROOST Coop before 1.0.2 stems from the SAML verify callback resolving the authenticated user by email only, without binding that lookup to the organization named in the /saml/login/:orgId/callback path. An attacker who administers any organization on the instance and controls its SAML IdP signing key can post an assertion for a victim's email to a different organization's callback when the target organization has registered the same signing certificate, and receive a session as that victim. The attack is authenticated (PR:H in the vendor vector, since registering a SAML IdP requires organization administrator rights) and is only exploitable in the unusual shared-certificate configuration; there is no KEV listing and no public exploit identified at time of analysis, and the decision signal places remediation in the this-week window.
Unauthenticated GraphQL queries against Coop deployments earlier than 1.0.0 expose organization records and reviewer identity data, including org IDs, names, email addresses, website URLs, on-call alert addresses, and reviewers' IDs, names, roles, permissions, and creation dates. The flaw is missing authentication on the Query.allOrgs field reachable at /api/v1/graphql, rated CVSS 8.7 (CWE-306); any publicly accessible instance is affected, while authenticated private network placement prevents outside querying. The vendor advisory includes a public proof-of-concept GraphQL query, and the issue is fixed in Coop 1.0.0 via PR #699 / commit b29242f.
Coop, the open source review and moderation tool from ROOST, fails to invalidate database-backed sessions when a user resets their password, so any session an attacker had already established survives the reset for up to the 30-day session maximum age. The flaw requires a prerequisite compromise - an attacker must already hold the victim's password and have created an authenticated session before the legitimate user completes a reset (PR:L, AT:P), meaning it grants no initial access on its own. It affects versions prior to 1.0.2 and is fixed in 1.0.2; this is a low-severity issue (vendor CVSS 2.3) that only manifests after prior credential compromise and only when the victim performs the reset. No public exploit code is identified at time of analysis, and the priority label is monitor.
Cross-organization IDOR in Coop before 1.0.2 lets an authenticated user who holds MRT queue-edit permission grant or revoke another organization's users' access to that organization's manual review queues by supplying arbitrary queueId and userId values. The attacker cannot read the other organization's queues or jobs, so confidentiality is not affected; integrity and availability impact is limited to queue-access assignments. The vendor addressed this in 1.0.2, and no public exploit was identified at time of analysis.
Unauthenticated organization provisioning through the GraphQL Mutation.createOrg operation in ROOST Coop releases before 1.0.0 lets any remote actor who can reach a publicly exposed instance create arbitrary organization records and, with no rate limiting on the operation, generate log noise or drive database resource exhaustion. No credentials or user interaction are needed (PR:N/UI:N in the assessed vector), and impact stays bounded at low integrity and low availability with no confidentiality loss; the vendor's decisive limiting factor is network placement, since running Coop on an authenticated private network prevents outside actors from querying the GraphQL API at all. The issue is not in CISA KEV and no active exploitation is confirmed, a public PoC reference (a sample GraphQL mutation) exists in the advisory but is not verified as working exploit code, and the flaw is fixed in version 1.0.0.
Cross-tenant account takeover in ROOST Coop before 1.0.2 stems from the SAML verify callback resolving the authenticated user by email only, without binding that lookup to the organization named in the /saml/login/:orgId/callback path. An attacker who administers any organization on the instance and controls its SAML IdP signing key can post an assertion for a victim's email to a different organization's callback when the target organization has registered the same signing certificate, and receive a session as that victim. The attack is authenticated (PR:H in the vendor vector, since registering a SAML IdP requires organization administrator rights) and is only exploitable in the unusual shared-certificate configuration; there is no KEV listing and no public exploit identified at time of analysis, and the decision signal places remediation in the this-week window.
Unauthenticated GraphQL queries against Coop deployments earlier than 1.0.0 expose organization records and reviewer identity data, including org IDs, names, email addresses, website URLs, on-call alert addresses, and reviewers' IDs, names, roles, permissions, and creation dates. The flaw is missing authentication on the Query.allOrgs field reachable at /api/v1/graphql, rated CVSS 8.7 (CWE-306); any publicly accessible instance is affected, while authenticated private network placement prevents outside querying. The vendor advisory includes a public proof-of-concept GraphQL query, and the issue is fixed in Coop 1.0.0 via PR #699 / commit b29242f.
Coop, the open source review and moderation tool from ROOST, fails to invalidate database-backed sessions when a user resets their password, so any session an attacker had already established survives the reset for up to the 30-day session maximum age. The flaw requires a prerequisite compromise - an attacker must already hold the victim's password and have created an authenticated session before the legitimate user completes a reset (PR:L, AT:P), meaning it grants no initial access on its own. It affects versions prior to 1.0.2 and is fixed in 1.0.2; this is a low-severity issue (vendor CVSS 2.3) that only manifests after prior credential compromise and only when the victim performs the reset. No public exploit code is identified at time of analysis, and the priority label is monitor.
Cross-organization IDOR in Coop before 1.0.2 lets an authenticated user who holds MRT queue-edit permission grant or revoke another organization's users' access to that organization's manual review queues by supplying arbitrary queueId and userId values. The attacker cannot read the other organization's queues or jobs, so confidentiality is not affected; integrity and availability impact is limited to queue-access assignments. The vendor addressed this in 1.0.2, and no public exploit was identified at time of analysis.
Unauthenticated organization provisioning through the GraphQL Mutation.createOrg operation in ROOST Coop releases before 1.0.0 lets any remote actor who can reach a publicly exposed instance create arbitrary organization records and, with no rate limiting on the operation, generate log noise or drive database resource exhaustion. No credentials or user interaction are needed (PR:N/UI:N in the assessed vector), and impact stays bounded at low integrity and low availability with no confidentiality loss; the vendor's decisive limiting factor is network placement, since running Coop on an authenticated private network prevents outside actors from querying the GraphQL API at all. The issue is not in CISA KEV and no active exploitation is confirmed, a public PoC reference (a sample GraphQL mutation) exists in the advisory but is not verified as working exploit code, and the flaw is fixed in version 1.0.0.