Read the docs
TI-2026-83441 Aliases CVE-2026-63396

Coop exposes organization and user data through unauthenticated GraphQL query

Priority MEDIUM 43CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Coop, an open source review and moderation tool from ROOST, is affected before 1.0.0. An unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment, exposing data for all organizations, including names, email addresses, website URLs and on-call alert email addresses, and the usersWhoCanReviewEveryQueue field also exposes reviewing users' IDs, email addresses, names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from querying the GraphQL API directly. The weakness is CWE-306, Missing Authentication for Critical Functionality.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 24th percentileScored 2026-11-07
Fix Fixed coop (roostorg): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
roostorgcoopbefore 1.0.01.0.0Patch availableCNA
  • coop Vendorroostorg Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA

Remediation

Update roostorg coop to version 1.0.0, which fixes the issue. Running the service on an authenticated private network prevents direct outside access to the GraphQL API until the update is applied.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA coop (roostorg) Fixed in 1.0.0

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-63396
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2026-83442 Unauthenticated organization creation in Coop GraphQL API CVSS 4.0MEDIUM 6.9
  • TI-2026-83445 Coop SAML login flaw allows cross-tenant account takeover CVSS 4.0HIGH 7.4
  • TI-2026-83443 Coop lets users alter other organizations' review queue access CVSS 4.0MEDIUM 5.3
  • TI-2026-83446 Coop sessions stay valid after password reset CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences