Refine your search

5 vulnerabilities found for by roostorg

CVE-2026-63400 (GCVE-0-2026-63400)
Vulnerability from cvelistv5
Published
2026-10-30 22:46
Modified
2026-10-30 22:46
Severity ?
2.3 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-613 - Insufficient Session Expiration
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.
References
Impacted products
Vendor Product Version
roostorg coop Version: < 1.0.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "coop",
          "vendor": "roostorg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T22:46:10.154Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2"
        },
        {
          "name": "https://github.com/roostorg/coop/pull/778",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/pull/778"
        },
        {
          "name": "https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8"
        },
        {
          "name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-g5xq-67g7-36r2",
        "discovery": "UNKNOWN"
      },
      "title": "Coop sessions are not invalidated on password reset"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63400",
    "datePublished": "2026-10-30T22:46:10.154Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-10-30T22:46:10.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63398 (GCVE-0-2026-63398)
Vulnerability from cvelistv5
Published
2026-10-30 22:44
Modified
2026-11-02 17:56
Severity ?
7.4 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-287 - Improper Authentication
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.
References
Impacted products
Vendor Product Version
roostorg coop Version: < 1.0.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T17:09:34.942380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T17:56:56.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "coop",
          "vendor": "roostorg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy\u0027s verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization\u0027s callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T22:44:43.092Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2"
        },
        {
          "name": "https://github.com/roostorg/coop/pull/783",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/pull/783"
        },
        {
          "name": "https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071"
        },
        {
          "name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2v93-383c-9fw2",
        "discovery": "UNKNOWN"
      },
      "title": "Coop has SAML cross-tenant authentication bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63398",
    "datePublished": "2026-10-30T22:44:43.092Z",
    "dateReserved": "2026-07-16T19:20:28.986Z",
    "dateUpdated": "2026-11-02T17:56:56.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63401 (GCVE-0-2026-63401)
Vulnerability from cvelistv5
Published
2026-10-30 22:43
Modified
2026-11-02 14:49
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.
References
Impacted products
Vendor Product Version
roostorg coop Version: < 1.0.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:48:56.177801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:49:10.279Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "coop",
          "vendor": "roostorg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization\u0027s users\u0027 access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller\u0027s organization. The attacker could not read the other organization\u0027s queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T22:43:31.969Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/roostorg/coop/security/advisories/GHSA-mf74-gf5j-hxr9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/roostorg/coop/security/advisories/GHSA-mf74-gf5j-hxr9"
        },
        {
          "name": "https://github.com/roostorg/coop/pull/872",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/pull/872"
        },
        {
          "name": "https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f187ea63a8a7bebb8c4417088",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/commit/bd8fc6cc51de2d8f187ea63a8a7bebb8c4417088"
        },
        {
          "name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-mf74-gf5j-hxr9",
        "discovery": "UNKNOWN"
      },
      "title": "Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63401",
    "datePublished": "2026-10-30T22:43:31.969Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-11-02T14:49:10.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63396 (GCVE-0-2026-63396)
Vulnerability from cvelistv5
Published
2026-10-30 22:42
Modified
2026-11-02 17:57
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.
References
Impacted products
Vendor Product Version
roostorg coop Version: < 1.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63396",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T17:12:42.782789Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T17:57:28.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "coop",
          "vendor": "roostorg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users\u0027 IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T22:42:12.245Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4"
        },
        {
          "name": "https://github.com/roostorg/coop/pull/699",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/pull/699"
        },
        {
          "name": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c"
        },
        {
          "name": "https://github.com/roostorg/coop/releases/tag/1.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/releases/tag/1.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gv85-m34f-27g4",
        "discovery": "UNKNOWN"
      },
      "title": "Coop has a data leak via unauthenticated GraphQL Query.allOrgs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63396",
    "datePublished": "2026-10-30T22:42:12.245Z",
    "dateReserved": "2026-07-16T17:39:30.172Z",
    "dateUpdated": "2026-11-02T17:57:28.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63399 (GCVE-0-2026-63399)
Vulnerability from cvelistv5
Published
2026-10-30 22:40
Modified
2026-10-30 22:40
Severity ?
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
  • CWE-799 - Improper Control of Interaction Frequency
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
References
Impacted products
Vendor Product Version
roostorg coop Version: < 1.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "coop",
          "vendor": "roostorg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-799",
              "description": "CWE-799: Improper Control of Interaction Frequency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T22:40:29.297Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475"
        },
        {
          "name": "https://github.com/roostorg/coop/pull/699",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/pull/699"
        },
        {
          "name": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c"
        },
        {
          "name": "https://github.com/roostorg/coop/releases/tag/1.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roostorg/coop/releases/tag/1.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jcph-g6qv-g475",
        "discovery": "UNKNOWN"
      },
      "title": "Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63399",
    "datePublished": "2026-10-30T22:40:29.297Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-10-30T22:40:29.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}