CVE-2026-63396 | Roost Coop up to 0.x GraphQL API /api/v1/graphql Query.allOrgs usersWhoCanReviewEveryQueue access control

October 31, 2026 Yanac

A vulnerability, which was classified as problematic, has been found in Roost Coop up to 0.x. Affected by this vulnerability is the function Query.allOrgs of the file /api/v1/graphql of the component GraphQL API. This manipulation of the argument usersWhoCanReviewEveryQueue causes improper access controls.

This vulnerability is handled as CVE-2026-63396. The attack can be initiated remotely. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More