The GraphQL Mutation.createOrg operation in Coop, prior to version 1.0.0, allows any actor to create arbitrary organizations on a publicly accessible instance without authentication. This flaw can be exploited to create noise in logs and, because rate limiting is absent, may lead to database exhaustion. The vulnerability is a classic example of unchecked permissions (CWE‑306) and can also cause excessive resource consumption (CWE‑799).

The affected product is Coop by Roostorg, specifically all versions released before 1.0.0. Users running any pre‑1.0.0 build over a public network are susceptible.

The CVSS score of 6.9 indicates a moderate level of severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not be actively exploited at large scale yet. The attack vector is network‑based, targeting the public GraphQL API endpoint. An attacker can simply send a mutation request to create an organization, potentially consuming database resources and causing denial of service by overwhelming the system. As there is no authentication required, the exploit can be performed from any external network that can reach the public API.