Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-63396Coop has a data leak via unauthenticated GraphQL Query.allOrgs

High 8.7

In plain English

A high-severity missing authentication in coop from roostorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 76.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.

Affected products (as reported)

Vendor	Product	Versions
roostorg	coop	< 1.0.0

Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4 x_refsource_CONFIRM
https://github.com/roostorg/coop/pull/699 x_refsource_MISC
https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c x_refsource_MISC
https://github.com/roostorg/coop/releases/tag/1.0.0 x_refsource_MISC