Read the docs
TI-2026-85056 Aliases CVE-2026-121945GHSA-8jxw-hq6x-qqhf

Broken access control in CoopCycle coopcycle-web lets couriers modify incidents

Priority HIGH 65CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

CoopCycle coopcycle-web before 6.20.1 contains an authorization bypass through a user-controlled key (CWE-639). Incident operations only check the ROLE_COURIER role, so any courier can read and modify every incident by enumerating sequential incident ids. An authenticated courier with low privileges can use the incident action endpoint to re-price, cancel or reschedule other stores' orders and tasks.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix Fixed coopcycle-web (CoopCycle): 6.20.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CoopCyclecoopcycle-webbefore 6.20.16.20.1Patch availableCNA
  • coopcycle-web VendorCoopCycle Affected before 6.20.1 Fixed in 6.20.1 Patch available CNA

Remediation

Upgrade coopcycle-web to version 6.20.1 or later, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA coopcycle-web (CoopCycle) Fixed in 6.20.1

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121945
  2. 2026-11-04 Alias added: GHSA-8jxw-hq6x-qqhf
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → HIGH

References

Patch 1

Advisory 1

Other 2

  • TI-2026-85046 Missing Zelty webhook signature verification in CoopCycle coopcycle-web CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences