CVE-2026-121620: CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification
CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/ endpoints to toggle restaurant products and alter order preparation states.
Event History
Frequently Asked Questions
Which deployments are exposed?
CoopCycle coopcycle-web installations running version 5.6.0 or later but before 6.20.0 are affected if the Zelty webhook endpoints are reachable. The affected endpoints are under /api/zelty/webhook/*.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to send forged HTTP POST requests to the Zelty webhook endpoints; the application does not verify the x-zelty-hmac-sha256 signature.
What can a successful attacker do?
Forged events can affect dishes, menus, options, and order status. This can toggle restaurant products and alter order preparation states.
What version addresses the issue?
Version 6.20.0 includes the fix. Upgrading from an affected version to 6.20.0 or later addresses the missing webhook signature verification.