Is CVE-2026-63401 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63401 being exploited in the wild.

How severe is CVE-2026-63401?

Informational severity, published 30 October 2026.

Is there a fix for CVE-2026-63401?

Yes: fixed in 1.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63401 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63401?

Check whether you run ROOST Coop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63401: ROOST Coop unauthorized cross-organization queue access

CVE-2026-63401 · Severity: info · Published 2026-10-30

Coop is an open source review and moderation tool used by organizations to manage content queues and user access controls. An authenticated user in one organization could grant or revoke another organization's users' access to manual review queues, disrupting their workflow and access permissions. While the attacker could not view or modify the other organization's data, they could manipulate access controls, affecting queue operations availability.

Technologies: ROOST Coop. Vendors: ROOST.

Quick answers

Is CVE-2026-63401 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63401 being exploited in the wild.
How severe is CVE-2026-63401?: Informational severity, published 30 October 2026.
Which products and versions are affected?: ROOST Coop prior to 1.0.2.
Is there a fix for CVE-2026-63401?: Yes: fixed in 1.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63401 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63401?: Check whether you run ROOST Coop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.0.2

Technical details

The `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` functions in ManualReviewToolService failed to validate that supplied queueId and userId parameters belonged to the caller's organization, enabling an IDOR (Insecure Direct Object Reference) attack across org boundaries. An authenticated user with MRT queue-edit permission could pass arbitrary identifiers without organization scoping. The vulnerability was fixed by threading the caller's orgId through the resolver and service layer and adding pre-write validation to reject cross-org mutations.

Affected products

ROOST Coop prior to 1.0.2

Timeline

2026-10-30: disclosed
2026-06-30: patched: Fix committed via PR #872

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.