Riskcovery

CVE-2026-63399

Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

State
Published
Severity
6.9 Medium
Published
Oct 30, 2026
Updated
Oct 30, 2026
Reserved
Jul 16, 2026

Read the record on cve.org

Description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NGitHub_M

Weaknesses

  • CWE-306 Missing Authentication for Critical Function
  • CWE-799 Improper Control of Interaction Frequency

Affected Products

ProductVersions
cooproostorg
  • < 1.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.