CVE-2026-63399: fallo de gravedad media en roostorg coop
Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.3%
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
roostorg · coopCVEs relacionadas — roostorg coop
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-63396HIGHCoop has a data leak via unauthenticated GraphQL Query.allOrgsEPSS 0.3%CVE-2026-63400LOWCoop sessions are not invalidated on password resetEPSS 0.3%CVE-2026-63401MEDIUMCoop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUserEPSS 0.3%CVE-2026-63398HIGHCoop has SAML cross-tenant authentication bypassEPSS 0.2%