Read the docs
TI-2026-85046 Aliases CVE-2026-121620GHSA-fffc-w3w6-p7qp

Missing Zelty webhook signature verification in CoopCycle coopcycle-web

Priority LOW 35CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

CoopCycle coopcycle-web from 5.6.0 before 6.20.0 does not verify the x-zelty-hmac-sha256 HMAC signature on incoming Zelty webhooks, which is CWE-345 (insufficient verification of data authenticity). An unauthenticated remote attacker can send forged dish, menu, option and order-status events to the /api/zelty/webhook/* endpoints. This lets the attacker toggle restaurant products and alter order preparation states.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00221 12th percentileScored 2026-11-07
Fix Fixed coopcycle-web (CoopCycle): 6.20.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CoopCyclecoopcycle-web5.6.0 to before 6.20.06.20.0Patch availableCNA
  • coopcycle-web VendorCoopCycle Affected 5.6.0 to before 6.20.0 Fixed in 6.20.0 Patch available CNA

Remediation

Upgrade CoopCycle coopcycle-web to version 6.20.0 or later, which fixes the flaw. The sources list no fixed version for CoopCycle coopcycle-web earlier than 6.20.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA coopcycle-web (CoopCycle) Fixed in 6.20.0

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121620
  2. 2026-11-04 Alias added: GHSA-fffc-w3w6-p7qp
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → LOW

References

Patch 1

Other 3

  • TI-2026-85056 Broken access control in CoopCycle coopcycle-web lets couriers modify incidents CVSS 4.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences