Missing Authentication Vulnerability in CoopCycle Web Application
CVE-2026-121620

8.3HIGH

Key Information:

Vendor

Coopcycle

Status
Coopcycle-web
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121620?

The CoopCycle web application prior to version 6.20.0 has a vulnerability related to a missing authentication check for webhook events from Zelty. This oversight allows attackers to forge webhook events without being verified, specifically the x-zelty-hmac-sha256 HMAC signature. As a result, unauthorized individuals can send forged requests to the /api/zelty/webhook/* endpoints, allowing them to alter restaurant product statuses and manipulate order preparation phases. It is crucial for users of the affected versions to upgrade to version 6.20.0 or later to mitigate this risk.

Affected Version(s)

coopcycle-web 5.6.0 < 6.20.0

References

https://github.com/coopcycle/coopcycle-web/commit/9b49995...
patch
https://github.com/coopcycle/coopcycle-web/releases/tag/v...
release-notes
https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/c...
technical-description

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Florian Kabashi
.