CVE-2026-63399: medium-severity vulnerability in roostorg coop
Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.3%
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
roostorg · coopRelated CVEs — roostorg coop
In the same product, most dangerous first.
CVE-2026-63396HIGHCoop has a data leak via unauthenticated GraphQL Query.allOrgsEPSS 0.3%CVE-2026-63400LOWCoop sessions are not invalidated on password resetEPSS 0.3%CVE-2026-63401MEDIUMCoop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUserEPSS 0.3%CVE-2026-63398HIGHCoop has SAML cross-tenant authentication bypassEPSS 0.2%