Unauthenticated Data Exposure in Coop Review Tool from ROOST

CVE-2026-63396

What is CVE-2026-63396?

The Coop review and moderation tool from ROOST contains a vulnerability that allows unauthenticated individuals to access sensitive organizational data via the GraphQL API. Before version 1.0.0, attackers could exploit the /api/v1/graphql endpoint to retrieve information such as organization IDs, names, email addresses, website URLs, and alert emails of on-call personnel. Additionally, the breach could expose user identifiers, personal information, and permissions of users with review capabilities. This raises significant risks for data privacy and organizational security, especially when the service is deployed publicly. To mitigate this vulnerability, it’s imperative to upgrade to version 1.0.0 or employ appropriate network defenses to limit access.

References