Coop has a data leak via unauthenticated GraphQL Query.allOrgs
Impact
Coop, an open source review tool, has a data leak via an unauthenticated GraphQL query, affecting versions prior to 1.0.0. An unauthenticated actor can obtain organization and user data. Running the service on a private network may prevent outside access.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
roostorg · GitHub_M
coop
1 range
roostorg · GitHub_M
coop
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 1.0.0
Other versions: unknown
Original source description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The usersWhoCanReviewEveryQueue field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-63396View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.