CVE-2026-63398
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In Coop prior to 1.0.2, the SAML strategy verify callback resolved the authenticated user by email alone using kyselyUserFindByEmail, without binding the lookup to the organization in /saml/login/:orgId/callback. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate.
Risk Assessment
Cross-tenant account takeover of a victim in another organization is possible without privileges in the target organization, provided the unusual matching-certificate configuration exists.
Recommendation
Update Coop to version 1.0.2 or later, which binds the user lookup to the organization.
Other vulnerabilities in Coop
See all- CVE-2026-63401Medium
In Coop before 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data.
- CVE-2026-63400Low
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age.
- CVE-2026-63399Medium
In Coop before 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API.
- CVE-2026-63396High
In Coop prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including IDs, names, email addresses, website URLs and on-call alert email addresses. The usersWhoCanReviewEveryQueue field also exposes reviewing users' IDs, email addresses, names, roles, permissions and creation dates.
Original NVD description (English source)
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS