{"id":"CVE-2026-121620","kind":"vulnerability","aliases":["CVE-2026-121620"],"related":[],"title":"CoopCycle web: forged Zelty webhooks can alter restaurant orders and menus","description":"CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.","summary":"CoopCycle's web app from 5.6.0 up to (not including) 6.20.0 never checks the HMAC signature on incoming Zelty webhook events. An unauthenticated attacker can send forged events to the webhook endpoints to toggle restaurant products and change order preparation states.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coopcycle","food-delivery","other","self-hosted","zelty"],"not_affected_if":["default-config","not-using-zelty"],"how_to_check":"- Check the installed coopcycle-web version against the fixed range (`6.20.0`).\n- Look at whether the app exposes `/api/zelty/webhook/*` endpoints and whether Zelty integration is enabled.","fix":"- coopcycle-web: upgrade to `6.20.0` or later.","status":"open","published_at":"2026-11-04T13:17:27+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","triaged_at":"2026-11-04T13:27:56+00:00","updated_at":"2026-11-04T13:27:56+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T13:27:56Z","model":"claude-haiku-5-5","output":{"fix":"- coopcycle-web: upgrade to `6.20.0` or later.","reach":"internet","title":"CoopCycle web: forged Zelty webhooks can alter restaurant orders and menus","impact":"medium","summary":"CoopCycle's web app from 5.6.0 up to (not including) 6.20.0 never checks the HMAC signature on incoming Zelty webhook events. An unauthenticated attacker can send forged events to the webhook endpoints to toggle restaurant products and change order preparation states.","audience":"businesses","category":"other","nicknames":[],"who_cares":["coopcycle","self-hosted","zelty","food-delivery"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker alters restaurant menus and order preparation states remotely","analyst_note":"Confirm whether the Zelty integration is enabled by default and check the vendor patch notes at the linked release page.","how_to_check":"- Check the installed coopcycle-web version against the fixed range (`6.20.0`).\n- Look at whether the app exposes `/api/zelty/webhook/*` endpoints and whether Zelty integration is enabled.\n- unknown whether the sources give a further check.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","not-using-zelty"],"who_is_affected":"Operators running a self-hosted CoopCycle web instance from 5.6.0 up to 6.20.0 that receive Zelty webhooks. Deployments not using the Zelty integration, or on versions outside that range, are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4227,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121620':14A,17A '-2026':13A,16A '/api/zelty/webhook':114C '5.6.0':32B,72C '6.20.0':37B,74C 'allow':81C 'alter':7A,121C 'app':30B 'attack':50B,83C,101C 'authent':78C 'chang':64B 'check':39B 'contain':75C 'coopcycl':1A,18B,27B,68C,70C 'coopcycle-web':69C 'cve':12A,15A 'deliveri':21B 'dish':105C 'endpoint':58B,115C 'event':47B,54B,88C,112C 'food':20B 'food-deliveri':19B 'forg':3A,53B,85C,104C 'hmac':41B,94C,96C 'host':25B 'includ':36B 'incom':44B 'menu':106C 'menus':11A 'miss':77C 'never':38B,99C 'option':107C 'order':9A,65B,110C,122C 'order-status':109C 'post':103C 'prepar':66B,123C 'product':62B,119C 'restaur':8A,61B,118C 'self':24B 'self-host':23B 'send':52B 'sha256':95C 'signatur':42B,97C 'state':67B,124C 'status':111C 'toggl':60B,117C 'unauthent':49B,82C 'verifi':100C 'vulner':79C 'web':2A,29B,71C 'webhook':5A,46B,57B,87C 'x':92C 'x-zelty-hmac-sha256':91C 'zelti':4A,26B,45B,86C,93C","nicknames":[],"mitigations":[],"who_affected":"Operators running a self-hosted CoopCycle web instance from 5.6.0 up to 6.20.0 that receive Zelty webhooks. Deployments not using the Zelty integration, or on versions outside that range, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coopcycle","fooddelivery","high","other","selfhosted","zelty"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121620","severity":null,"published_at":"2026-11-04T13:17:27+00:00","modified_at":"2026-11-04T13:17:27+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","fetched_at":"2026-11-04T13:27:01+00:00","note":null}],"documents":[{"id":67064,"url":"https://github.com/coopcycle/coopcycle-web/commit/9b499950d433ca8ba894996d6b17f49885ca9485","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67065,"url":"https://github.com/coopcycle/coopcycle-web/releases/tag/v6.20.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":67066,"url":"https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-5.6.0-before-6.20.0-missing-zelty-webhook-signature-verification","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}