Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Affects Coop versions before 1.0.0 on public instances, where the GraphQL createOrg mutation can be called without authentication. Fixed in 1.0.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 1.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Coop, an open source review and moderation tool from ROOST, is affected. An unauthenticated attacker on a publicly accessible instance can create arbitrary organizations through its GraphQL API, which clutters the logs and, due to missing rate limiting, could potentially exhaust the database.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- roostorg coop
fixed in 1.0.0
References 4
GitHub · roostorg/coop
Questions about CVE-2026-63399
What does this mean?
Coop's GraphQL Mutation.createOrg can be called without logging in, so an outside party reaching a public instance can create arbitrary organizations. This adds log noise and could exhaust the database because there is no rate limiting.Source: github.com
Am I affected, and how do I check?
Coop versions before 1.0.0 are in scope, and the issue concerns instances that are reachable from outside. Check the installed Coop version to see whether it is below 1.0.0.Source: github.com
What should I do about it?
Upgrade Coop to 1.0.0, which contains the fix. If upgrading is not possible, run Coop on an authenticated private network so outside parties cannot query the GraphQL API directly.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data