CVE-2026-63399 Details
Description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
A vulnerability in Roost Coop prior to version 1.0.0 allows unauthenticated users to create arbitrary organizations through the GraphQL Mutation.createOrg operation. This issue can lead to unauthorized organization creation on publicly accessible instances, causing unnecessary log clutter and potentially exhausting database resources due to the absence of rate limiting. While the vulnerability is not exploitable on authenticated private networks, it was present in versions prior to 1.0.0, which has since been released and addresses this issue.
Update to Roost Coop version 1.0.0 or later, and consider running the application on an authenticated private network to prevent external access to the GraphQL API.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c | [email protected] | Source CodeVendor |
| https://github.com/roostorg/coop/pull/699 | [email protected] | Source CodeVendor |
| https://github.com/roostorg/coop/releases/tag/1.0.0 | [email protected] | Release NotesVendor |
| https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-799 | Improper Control of Interaction Frequency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ROOST Coop | < 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |