CoopCycle web: any courier can read and change every incident

CoopCycle's web app checks only that a user is a courier before letting them read and modify incidents, so any courier account can access incidents belonging to other stores. An attacker with a courier account can enumerate sequential incident ids and use the incident action endpoint to re-price, cancel or reschedule other stores' orders and tasks.