CVE-2026-63399

Received Received - Intake

Unauthenticated GraphQL Organization Creation in Coop

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63399

Affected Vendors & Products

Vendor	Product	Version / Range
roostorg	coop	< 1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-799	The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is in Coop, an open source review and moderation tool. It allows unauthenticated users to create arbitrary organizations via the GraphQL Mutation.createOrg operation on publicly accessible instances. This can cause log noise and potentially exhaust database resources due to lack of rate limiting. The issue is fixed in version 1.0.0.

Detection Guidance

Check if unauthenticated GraphQL mutations are allowed by sending a test request to the Mutation.createOrg endpoint. Monitor logs for unusual organization creation activity or database performance issues.

Impact Analysis

Unauthenticated attackers could create fake organizations, cluttering logs and potentially overwhelming the database with excessive requests. If the service runs on a private authenticated network, external actors cannot directly exploit this.

Mitigation Strategies

Upgrade Coop to version 1.0.0 or later. If upgrading is not immediately possible, restrict network access to the GraphQL API by running the service on a private authenticated network.

Hi! I’m here to help you understand CVE-2026-63399. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70