Coop CVE-2026-63396

The only prerequisite is that the Coop instance (version < 1.0.0) be reachable over the network - specifically a publicly accessible deployment exposing the /api/v1/graphql endpoint. No authentication, credentials, privileges, or user interaction are required, and default public deployments are vulnerable to the unauthenticated allOrgs/usersWhoCanReviewEveryQueue query. The decisive limiting factor stated by the vendor is network placement: running Coop on an authenticated, private network prevents outside actors from directly querying the GraphQL API and removes external exposure, and upgrading to 1.0.0 (which enforces authenticated, org-matched query checks) is the complete fix.

This is a genuine, easy-to-exploit information-disclosure flaw (CWE-306, missing authentication) rather than an inflated high-CVSS issue, though its real-world urgency is moderated by low product prevalence. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) and the GHSA advisory agree: an unauthenticated network actor can read sensitive data with a single POST, with no privileges, no user interaction, and low complexity. Impact is confidentiality-only - VI:N and VA:N confirm no integrity or availability effect - so the scoring is internally consistent and not contradictory. The vuln.today decision label is 'this_week' (not act_now/emergency), and the CVE is NOT in CISA KEV; no EPSS score was supplied in the input, so exploitation probability cannot be quantified here. A working proof-of-concept GraphQL query is published directly in the GHSA advisory, which materially lowers the barrier to opportunistic scanning, but there is no evidence of active exploitation. The chief factor keeping this below top priority is deployment footprint: Coop is a niche open-source trust-and-safety tool, and the advisory itself notes the API is only exposed when the service is run on a publicly accessible network, so many deployments on private networks are not directly reachable.

An attacker enumerates internet-exposed Coop instances and sends an unauthenticated HTTP POST to /api/v1/graphql with the allOrgs query documented in the advisory. In one request they harvest every organization's ID, name, email, website, and on-call alert email, plus the IDs, emails, names, roles, permissions, and creation dates of all users who can review any queue. A copy-paste PoC query is published in the GHSA advisory, and the low-complexity, unauthenticated network vector (AV:N/AC:L/PR:N/UI:N) makes this trivially repeatable at scale against public deployments.