Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: CoopCycle Clear all filters
TI-2026-85046 CVE-2026-121620 · GHSA-fffc-w3w6-p7qp

Missing Zelty webhook signature verification in CoopCycle coopcycle-web

Priority LOW 35

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never veri…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00221 Published 2026-11-04 Fixed in 6.20.0 CWE-345
TI-2026-85056 CVE-2026-121945 · GHSA-8jxw-hq6x-qqhf

Broken access control in CoopCycle coopcycle-web lets couriers modify incidents

Priority HIGH 65

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00406 Published 2026-11-04 Fixed in 6.20.1 CWE-639