---
id: "CVE-2026-121620"
kind: "vulnerability"
aliases: ["CVE-2026-121620"]
title: "CoopCycle web: forged Zelty webhooks can alter restaurant orders and menus"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["coopcycle", "food-delivery", "other", "self-hosted", "zelty"]
not_affected_if: ["default-config", "not-using-zelty"]
published_at: "2026-11-04T13:17:27+00:00"
first_seen_at: "2026-11-04T13:27:01+00:00"
updated_at: "2026-11-04T13:27:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121620", "first_seen_at": "2026-11-04T13:27:01+00:00"}]
---

# CoopCycle web: forged Zelty webhooks can alter restaurant orders and menus

CoopCycle's web app from 5.6.0 up to (not including) 6.20.0 never checks the HMAC signature on incoming Zelty webhook events. An unauthenticated attacker can send forged events to the webhook endpoints to toggle restaurant products and change order preparation states.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed coopcycle-web version against the fixed range (`6.20.0`).
- Look at whether the app exposes `/api/zelty/webhook/*` endpoints and whether Zelty integration is enabled.

## Fix

- coopcycle-web: upgrade to `6.20.0` or later.

## Timeline

- 2026-11-04T13:27:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121620

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-5.6.0-before-6.20.0-missing-zelty-webhook-signature-verification
- [fix] Patch: github.com https://github.com/coopcycle/coopcycle-web/commit/9b499950d433ca8ba894996d6b17f49885ca9485
- [fix] Release notes: github.com https://github.com/coopcycle/coopcycle-web/releases/tag/v6.20.0

## From the sources

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_