Broken Access Control Vulnerability in CoopCycle Web by CoopCycle

CVE-2026-121945

What is CVE-2026-121945?

The CoopCycle coopcycle-web application prior to version 6.20.1 is susceptible to a broken access control vulnerability. This weakness allows authorized couriers to exploit incident operations that only validate the ROLE_COURIER permission. As a result, any courier can gain unauthorized access to read and modify incidents across the platform. Attackers could potentially enumerate incident IDs and use the PUT /api/incidents/{id}/action endpoint to alter pricing, cancel orders, or reschedule tasks belonging to other stores, leading to significant operational disruption.

References