CVE-2026-121945: CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint
CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLECOURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with the ROLE_COURIER role can exploit it. The attacker does not need access to the affected store or incident; they can enumerate sequential incident IDs.
Which deployments are affected?
CoopCycle coopcycle-web versions before 6.20.1 are affected. The vulnerable incident operations authorize requests based only on ROLE_COURIER.
What actions can an attacker perform?
An attacker can read and modify incidents belonging to other stores. Through PUT /api/incidents/{id}/action, they can re-price, cancel, or reschedule other stores' orders and tasks.
How can I check for attempted exploitation?
Review requests to PUT /api/incidents/{id}/action for courier accounts acting on incident IDs belonging to stores they are not authorized to access. Sequential requests across multiple incident IDs may indicate enumeration.