CVE-2026-63399
Coop is an open source review and moderation tool from ROOST
- Risk score
- 41/100
- CVSS
- 6.9 v4.0
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to data…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.0.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.9 medium
References
Original description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
Last activity 30 Oct 2026. Patch Forecast updates every hour.