Unauthenticated GraphQL Query Exposing Sensitive Org Data in Coop

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63396

Affected Vendors & Products

Vendor	Product	Version / Range
roostorg	coop	< 1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability allows unauthenticated users to query sensitive organization and user data through a publicly accessible GraphQL API endpoint. The exposed data includes organization IDs, names, emails, websites, and alert emails, as well as reviewing users' personal details like names, roles, and permissions.

Impact Analysis

Unauthenticated attackers could harvest sensitive information about organizations and users, potentially leading to privacy breaches, targeted phishing attacks, or unauthorized access to internal systems. The exposure of user roles and permissions may also aid in further exploitation.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized processing of personal data and potential failure to implement adequate security measures. It may also breach HIPAA if protected health information is exposed. Organizations must ensure proper access controls to maintain compliance.

Hi! I’m here to help you understand CVE-2026-63396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70