ROOST Coop CVE-2026-63399

Exploitation requires a Coop instance (version < 1.0.0) whose GraphQL API is reachable from an untrusted network - i.e. a publicly-accessible deployment. On such an instance the Mutation.createOrg operation performs no authentication check, so no credentials, tokens, or user interaction are needed. The decisive limiting factor stated by the vendor is network placement: running Coop on an authenticated private network prevents outside actors from directly querying the GraphQL API and removes this attack surface. Impact is also inherently bounded - the attacker can only create organization records and leverage the absence of rate limiting for log noise or database exhaustion, not read data or execute code.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and CWE-306 correctly describe a missing-authentication flaw reachable by any remote actor with no privileges or user interaction, and the input confirms PR:N so the actor is unauthenticated. However, the technical impact is deliberately scored low across the board (VC:L/VI:L/VA:L, SC:N): the attacker can only create junk organization records and, because of a companion rate-limiting weakness (CWE-799), potentially drive database exhaustion - there is no code execution, data theft, or takeover. The vuln.today decision label is 'this_month', which aligns with a moderate severity rather than act_now/emergency. No EPSS score and no CISA KEV entry are present in the input, so there is no signal of active exploitation; absence of these is not evidence of safety but does argue against widespread automated attack at this time. A functional proof-of-concept GraphQL mutation is published in the GHSA advisory itself, which lowers the practical barrier to abuse. The single largest risk-limiting factor is deployment exposure: the flaw only matters on an instance whose GraphQL API is reachable from an untrusted network, so environments running Coop behind an authenticated private network face substantially reduced real-world risk.

An attacker locates an internet-exposed Coop instance and sends the unauthenticated GraphQL Mutation.createOrg request shown in the published advisory PoC, creating a bogus organization with no credentials. By scripting this call in a loop against the unrate-limited endpoint, the attacker floods the backend with spurious organizations, generating log noise and potentially exhausting the database. The attack is low-complexity and network-based, but only succeeds where the GraphQL API is publicly reachable.