CVE-2026-63399— Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

Quick assessment

Affected

roostorg coop

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Coop 是由 ROOST 开发的一款开源审核与内容管理工具。在 1.0.0 版本之前，的操作允许未认证用户在可公开访问的实例上创建任意组织。除了会在日志中产生大量干扰信息外，由于缺乏速率限制，该问题还可能导致数据库资源耗尽。将服务部署在需要身份认证的私有网络中，可防止外部用户直接查询 API。此问题已在 1.0.0 版本中修复。

CVSS 6.9 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1499 · Endpoint Denial of Service T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

Source: CVE Program / CVE List V5

Vulnerability Description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
roostorg	coop	< 1.0.0	-

II. Public POCs for CVE-2026-63399

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63399

请登录查看更多情报信息。

Other References for CVE-2026-63399 (4)

https://github.com/roostorg/coop/pull/699 x_refsource_MISC
https://github.com/roostorg/coop/releases/tag/1.0.0 x_refsource_MISC
https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475 x_refsource_CONFIRM
https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63399

Same Patch Batch · roostorg · 2026-10-30 · 5 CVEs total

CVE-2026-63396	8.7 HIGH	Coop has a data leak via unauthenticated GraphQL Query.allOrgs
CVE-2026-63398	7.4 HIGH	Coop has SAML cross-tenant authentication bypass
CVE-2026-63401	5.3 MEDIUM	Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
CVE-2026-63400	2.3 LOW	Coop sessions are not invalidated on password reset

IV. Related Vulnerabilities

Same product: coop

Same vendor: roostorg

Same weakness: CWE-306