Read the docs

CoopCycle

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

CoopCycle records in CISA KEV

No CoopCycle vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-85056 CVE-2026-121945 · GHSA-8jxw-hq6x-qqhf

Broken access control in CoopCycle coopcycle-web lets couriers modify incidents

Priority HIGH 65

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00406 Published 2026-11-04 Fixed in 6.20.1 CWE-639
TI-2026-85046 CVE-2026-121620 · GHSA-fffc-w3w6-p7qp

Missing Zelty webhook signature verification in CoopCycle coopcycle-web

Priority LOW 35

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never veri…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00221 Published 2026-11-04 Fixed in 6.20.0 CWE-345
Open these records in search →