GHSA-mf74-gf5j-hxr9: Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coopto a version that resolves this vulnerability.Fixed in 1.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who belongs to an organization and has MRT queue-edit permission can exploit it. They can target arbitrary queue and user identifiers from another organization.
What can an attacker do, and what are the limits?
An attacker can grant or revoke another organization's users' access to manual review queues. They cannot read the other organization's queues or jobs, so the issue does not disclose confidential queue or job data.
Are affected deployments fixed by an upgrade?
Yes. The issue is fixed in Coop version 1.0.2; versions prior to 1.0.2 are affected.