Coop: Missing authentication allows unauthenticated access to organization data
Summary
Coop, an open source review and moderation tool, exposes the GraphQL query Query.allOrgs at /api/v1/graphql without authentication on publicly accessible deployments. An unauthenticated attacker can retrieve organization IDs, names, email addresses, website URLs and on-call alert email addresses, and the usersWhoCanReviewEveryQueue field also reveals reviewers' email addresses, names, roles, permissions and creation dates. Running the service on an authenticated private network prevents direct external access to the API.
Affected
- roostorg Coop versions before 1.0.0
Fixed in
- Fixed in 1.0.0
- A related Coop advisory (CVE-2026-63398) lists fixes in 1.0.2; the latest release should be used
Workaround
- No vendor workaround known. Until the update is applied, restrict network access to the instance and place it behind a VPN or authentication. This is a compensating control, not a fix.
Exploitation
- Not known to be exploited.
- No public proof of concept or CISA KEV entry known at the time of writing.
Our recommendation
- Identify all Coop instances and check whether any are reachable from the internet.
- Upgrade to the latest release (at least 1.0.2) or move the instance behind a VPN or authentication immediately.
- Review logs for unusual GraphQL access to allOrgs and usersWhoCanReviewEveryQueue.
- If data was exposed, assess notification duties under applicable data protection law.
- Rotate or review reviewer accounts and alert addresses to reduce phishing risk.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gv85-m34f-27g4 github.com
- Coop release 1.0.0 github.com
- Fix commit b29242f github.com
- Pull request #699 github.com
- VulDB entry 429452 vuldb.com
- Strix CVE-2026-63396 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:15.
Original description (NVD)
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.