CVE-2026-63399

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c
https://github.com/roostorg/coop/pull/699
https://github.com/roostorg/coop/releases/tag/1.0.0
https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475

Configurations

No configuration.

History

30 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 23:17

Updated : 2026-10-30 23:17

NVD link : CVE-2026-63399

Mitre link : CVE-2026-63399

CVE.ORG link : CVE-2026-63399

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

CWE-799

Improper Control of Interaction Frequency

{"id": "CVE-2026-63399", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "roostorg", "product": "coop", "versions": [{"status": "affected", "version": "< 1.0.0"}]}]}], "published": "2026-10-30T23:17:14.987", "references": [{"url": "https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c", "source": "security-advisories@github.com"}, {"url": "https://github.com/roostorg/coop/pull/699", "source": "security-advisories@github.com"}, {"url": "https://github.com/roostorg/coop/releases/tag/1.0.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-799"}]}], "descriptions": [{"lang": "en", "value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0."}], "lastModified": "2026-10-30T23:17:14.987", "sourceIdentifier": "security-advisories@github.com"}