CVE-2026-63399

— UNSCOREDpublic exploit available

Published 2026-10-30 · Updated 2026-10-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.

Weaknesses

CWE-306, CWE-799

Public exploit & PoC references

https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c
https://github.com/roostorg/coop/pull/699
https://github.com/roostorg/coop/releases/tag/1.0.0
https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475

All references

https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c
https://github.com/roostorg/coop/pull/699
https://github.com/roostorg/coop/releases/tag/1.0.0
https://github.com/roostorg/coop/security/advisories/GHSA-jcph-g6qv-g475

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-5563
MEDIUMCVE-2025-13882
UNSCOREDCVE-2025-30043
UNSCOREDCVE-2025-30053
MEDIUMCVE-2025-36045
CRITICALCVE-2025-70516
MEDIUMCVE-2026-100192PoC
UNSCOREDCVE-2026-100406PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.