CVE-2026-121620 · Other
NO FIX YET · SEE WHAT TO DO
CoopCycle's web app from 5.6.0 up to (not including) 6.20.0 never checks the HMAC signature on incoming Zelty webhook events. An unauthenticated attacker can send forged events to the webhook endpoints to toggle restaurant products and change order preparation states.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Operators running a self-hosted CoopCycle web instance from 5.6.0 up to 6.20.0 that receive Zelty webhooks. Deployments not using the Zelty integration, or on versions outside that range, are not affected by this description.
Not affected if default-config, not-using-zelty
Who cares coopcycle, food-delivery, self-hosted, zelty
6.20.0)./api/zelty/webhook/* endpoints and whether Zelty integration is enabled.6.20.0 or later.CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.
This page as .md · .json · in your agent: get_signal("CVE-2026-121620") · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.