Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-63399Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

Medium 6.9

In plain English

A medium-severity missing authentication in coop from roostorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.

Affected products (as reported)

Vendor	Product	Versions
roostorg	coop	< 1.0.0

Weakness: CWE-306, CWE-799 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475 x_refsource_CONFIRM
https://github.com/roostorg/coop/pull/699 x_refsource_MISC
https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c x_refsource_MISC
https://github.com/roostorg/coop/releases/tag/1.0.0 x_refsource_MISC