CVE-2026-63396

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.

• CWE-306

• https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c
• https://github.com/roostorg/coop/pull/699
• https://github.com/roostorg/coop/releases/tag/1.0.0
• https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63385Libevent is an event notification library. Prior to 2.1.13 a…9.2
• CVE-2026-63386js-toml is a TOML parser for JavaScript. Prior to 1.1.3, loa…5.3
• CVE-2026-63387Libevent is an event notification library. Prior to 2.1.13 a…7
• CVE-2026-63388Libevent is an event notification library. Prior to 2.1.13 a…8.4
• CVE-2026-6339Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail …4.3
• CVE-2026-63393OpenSearch SQL supports querying OpenSearch data using SQL a…8.7
• CVE-2026-63397remorses/genql before version 6.3.4 allows an authenticated …6.4
• CVE-2026-63398Coop is an open source review and moderation tool from ROOST…7.4
• CVE-2026-63399Coop is an open source review and moderation tool from ROOST…6.9
• CVE-2026-6340Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…6.5
• CVE-2026-63400Coop is an open source review and moderation tool from ROOST…2.3
• CVE-2026-63401Coop is an open source review and moderation tool from ROOST…5.3