CVE-2026-63399

Name of the Vulnerable Software and Affected Versions Coop versions prior to 1.0.0

Description The GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. The absence of rate limiting for this operation could lead to database exhaustion and create excessive noise in the logs.

Recommendations Update to version 1.0.0. Run the service on an authenticated private network to prevent outside actors from directly querying the GraphQL API.