Coop has a data leak via unauthenticated GraphQL Query.allOrgs
Affects publicly accessible Coop deployments that expose the GraphQL API at /api/v1/graphql. Fixed in 1.0.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 1.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Coop, an open source review and moderation tool from ROOST, is affected when publicly accessible deployments allow unauthenticated access to its GraphQL API. An outside party could retrieve organization details such as names, email addresses, and website URLs, along with personal information about reviewing users, including email addresses, names, roles, and permissions.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- roostorg coop
fixed in 1.0.0
References 4
GitHub · roostorg/coop
Questions about CVE-2026-63396
What does this mean?
An unauthenticated outside caller can query the GraphQL allOrgs field and read data for every organization in the deployment, including org IDs, names, email addresses, website URLs and on-call alert emails. It also exposes details of users who can review org queues, such as emails, names, roles and permissions.Source: github.com
Am I affected, and how do I check?
The issue affects Coop deployments that are publicly accessible, meaning the /api/v1/graphql endpoint can be reached from outside the network. Versions before 1.0.0 are listed as affected, so compare your deployed Coop version against 1.0.0 and check whether the endpoint is reachable from outside.Source: github.com
What should I do about it?
Upgrade Coop to 1.0.0 or later, which contains the fix. If an upgrade is not possible right away, run Coop on authenticated, private networks rather than publicly accessible ones so outside actors cannot query the GraphQL API directly.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data