{"id":"CVE-2026-121945","kind":"vulnerability","aliases":["CVE-2026-121945"],"related":[],"title":"CoopCycle web: any courier can read and change every incident","description":"CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks.","summary":"CoopCycle's web app checks only that a user is a courier before letting them read and modify incidents, so any courier account can access incidents belonging to other stores. An attacker with a courier account can enumerate sequential incident ids and use the incident action endpoint to re-price, cancel or reschedule other stores' orders and tasks.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coopcycle","coopcycle-web","delivery-platform","package","self-hosted"],"not_affected_if":["coopcycle-web-6.20.1-or-later"],"how_to_check":"- Check the installed `coopcycle-web` version in the project's package manifest and confirm whether it is below `6.20.1`\n- Review whether courier accounts can call `PUT /api/incidents/{id}/action` on the deployed instance","fix":"- `coopcycle-web` `6.20.1` or later (per the advisory description: fixed in versions before 6.20.1 are affected)","status":"open","published_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","triaged_at":"2026-11-04T13:27:59+00:00","updated_at":"2026-11-04T13:27:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T13:27:59Z","model":"claude-haiku-5-5","output":{"fix":"- `coopcycle-web` `6.20.1` or later (per the advisory description: fixed in versions before 6.20.1 are affected)","reach":"internet","title":"CoopCycle web: any courier can read and change every incident","impact":"high","summary":"CoopCycle's web app checks only that a user is a courier before letting them read and modify incidents, so any courier account can access incidents belonging to other stores. An attacker with a courier account can enumerate sequential incident ids and use the incident action endpoint to re-price, cancel or reschedule other stores' orders and tasks.","audience":"businesses","category":"package","nicknames":[],"who_cares":["coopcycle","coopcycle-web","self-hosted","delivery-platform"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Courier account can alter other stores' orders and tasks","analyst_note":"","how_to_check":"- Check the installed `coopcycle-web` version in the project's package manifest and confirm whether it is below `6.20.1`\n- Review whether courier accounts can call `PUT /api/incidents/{id}/action` on the deployed instance","plain_action":"","needs_analyst":false,"not_affected_if":["coopcycle-web-6.20.1-or-later"],"who_is_affected":"Teams running a self-hosted or hosted CoopCycle instance with the coopcycle-web app. Exposure depends on courier accounts existing on the instance, since the flaw requires only the courier role; instances with no courier accounts are not exposed through this path.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4185,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121945':13A,16A '-2026':12A,15A '/action':127C '/api/incidents':125C '6.20.1':92C 'access':52B,96C 'account':50B,63B 'action':73B 'allow':100C 'app':31B 'attack':59B,116C 'belong':54B 'broken':95C 'cancel':79B,132C 'chang':8A 'check':32B,113C 'contain':93C 'control':97C 'coopcycl':1A,17B,19B,28B,87C,89C 'coopcycle-web':18B,88C 'courier':4A,39B,49B,62B,102C,115C 'cve':11A,14A 'deliveri':22B 'delivery-platform':21B 'endpoint':74B 'enumer':65B,118C 'everi':9A,107C 'host':27B 'id':68B,121C,126C 'incid':10A,46B,53B,67B,72B,108C,110C,120C 'let':41B 'modifi':45B,106C 'oper':111C 'order':84B,137C 'packag':24B 'platform':23B 'price':78B,131C 'put':124C 're':77B,130C 're-pric':76B,129C 'read':6A,43B,104C 'reschedul':81B,134C 'role':114C 'self':26B 'self-host':25B 'sequenti':66B,119C 'store':57B,83B,136C 'task':86B,139C 'use':70B,123C 'user':36B 'vulner':98C 'web':2A,20B,30B,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted or hosted CoopCycle instance with the coopcycle-web app. Exposure depends on courier accounts existing on the instance, since the flaw requires only the courier role; instances with no courier accounts are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coopcycle","coopcycleweb","deliveryplatform","high","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121945","severity":null,"published_at":"2026-11-04T13:17:29+00:00","modified_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","fetched_at":"2026-11-04T13:27:03+00:00","note":null}],"documents":[{"id":67093,"url":"https://github.com/coopcycle/coopcycle-web/commit/d997393d128afa1febe34e8f295b9511c12d19a0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67094,"url":"https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-before-6.20.1-idor-via-incident-resource-and-action-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}