CVE-2026-63399 in Coop
Summary
by MITRE • 10/31/2026
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in Coop versions prior to 1.0.0 represents a critical authentication bypass within its GraphQL interface, specifically targeting the Mutation.createOrg operation. As an open-source review and moderation tool developed by ROOST, Coop relies on API endpoints for administrative functions such as organization creation. In unpatched releases, this specific mutation endpoint fails to enforce any form of access control or user session validation. Consequently, any actor with network connectivity to a publicly accessible instance can invoke the createOrg function without providing valid credentials. This flaw effectively neutralizes the intended security boundary between public users and administrative capabilities, allowing external entities to perform actions that should be restricted to authenticated administrators.
From a technical perspective, this issue is classified as CWE-287: Improper Authentication. The GraphQL schema exposes the Mutation.createOrg endpoint without checking for valid authentication tokens or session cookies in the request headers. This lack of server-side validation allows unauthenticated requests to pass through the application layer and execute directly against the database backend. Furthermore, the absence of rate limiting mechanisms exacerbates the severity of this flaw. An attacker can programmatically generate a high volume of organization creation requests in rapid succession. While each individual request may seem benign, the cumulative effect creates significant operational risks including log flooding and resource exhaustion.
The operational impact of this vulnerability extends beyond simple unauthorized access to potential denial-of-service conditions. The ability for an unauthenticated actor to create arbitrary organizations introduces noise into system logs, which can obscure legitimate security events or administrative activities. More critically, if rate limiting is not implemented at the application or infrastructure level, repeated exploitation can lead to database exhaustion. Each organization creation typically involves inserting records into multiple related tables within the relational database schema. A sustained attack could consume available disk space, memory, and connection pools, rendering the service unavailable for legitimate users. This aligns with ATT&CK technique T1496: Resource Hijacking, where attackers leverage system resources to degrade performance or availability.
Mitigation strategies focus on both immediate remediation and long-term architectural improvements. The primary solution is upgrading Coop to version 1.0.0 or later, which includes the necessary authentication checks for administrative mutations. For environments that cannot immediately upgrade, deploying a reverse proxy with strict access control policies can restrict GraphQL endpoint visibility to trusted IP ranges only. Running the service on an authenticated private network prevents outside actors from directly querying the API, effectively mitigating remote exploitation. Additionally implementing rate limiting at the load balancer or application level is essential to prevent abuse even if authentication controls are bypassed. Regular security audits of GraphQL schemas should also be conducted to ensure that all mutations intended for administrative use enforce proper authorization checks consistent with industry standards like CWE-862: Missing Authorization.