CVE-2026-63396 Details

A data leakage vulnerability has been identified in Roost Coop, an open-source review and moderation tool, prior to version 1.0.0. The issue allows unauthenticated users to access sensitive information about all organizations on a publicly accessible deployment. This includes organization details such as IDs, names, email addresses, website URLs, and on-call alert emails. Additionally, the vulnerability exposes personal information of users who can review any queue for the organization, including user IDs, email addresses, names, roles, permissions, and account creation dates. The vulnerability arises from the 'Query.allOrgs' GraphQL query, which lacks proper authentication checks. Although running Coop on an authenticated private network can prevent such unauthorized access, this vulnerability highlights the risks associated with public deployments.

This vulnerability is fixed in Roost Coop version 1.0.0. Users should update to this version to address the issue. For those who cannot update, running Coop on an authenticated private network instead of a public one can help mitigate the vulnerability.