The vulnerability allows an unauthenticated participant to issue a GraphQL query to the public /api/v1/graphql endpoint and retrieve extensive organization data. The exposed fields include organization IDs, names, email addresses, website URLs and on‑call alert addresses, as well as reviewing users’ IDs, emails, personal names, roles, permissions and creation dates. This disclosure can reveal sensitive operational information, potentially enabling social engineering or further compromise.

Vendors: ROOST; Product: Coop; Affected versions: any release prior to 1.0.0. Only applying the 1.0.0 update removes the vulnerability. The public endpoint is available on standard deployments without authentication. No specific OS or infrastructure details are listed.

The CVSS score of 8.7 indicates high severity. EPSS is currently unavailable but the lack of a KEV listing does not reduce the likelihood of exploitation. The likely attack vector is an unauthenticated HTTP request to /api/v1/graphql, requiring no credentials, which aligns with CWE‑306 (Authentication Bypass). An attacker who can reach the public GraphQL interface can harvest personal and organizational data that could be leveraged for targeted phishing or insider‑credential fraud.