The flaw is an Insecure Direct Object Reference (CWE‑639) that lets an authenticated user in one organization with the MRT queue‑edit role arbitrarily add or remove access to manual review queues for users belonging to other organizations. The vulnerability does not expose or read any queue contents or job data; it only changes who is allowed to see or edit certain queues. The impact is limited to lateral extension of authorization boundaries within the Coop service.

Coop, the open‑source review and moderation tool distributed by Roost, is affected in all releases prior to version 1.0.2. Any installation of Coop older than 1.0.2 that runs the addAccessibleQueuesForUser or removeAccessibleQueuesForUser endpoints contains the vulnerability.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, so the probability of exploitation is unknown; the attack requires a legitimate authenticated session with MRT queue‑edit permission, which limits the pool of potential attackers. The vulnerability is not listed in CISA’s KEV catalog and does not expose sensitive data, but it enables unauthorized escalation of rights across organizational boundaries. Consequently the risk is moderate, and applying the fix promptly is advised.