CoopCycle coopcycle-web: Broken access control in incident management (CVE-2026-121945)

CoopCycle coopcycle-web before version 6.20.1 contains a broken access control vulnerability within its incident management system. The application improperly authorizes requests by only verifying the presence of the ROLE_COURIER role, failing to validate ownership or scope of the requested incident. This allows an authenticated courier to read and modify sensitive incident data across the platform.

Impact

Unauthorized actors can enumerate incident IDs and manipulate system state by issuing PUT requests to the /api/incidents/{id}/action endpoint. Documented impacts include the ability to re-price, cancel, or reschedule orders and tasks belonging to other stores.

Recommendation

• Upgrade coopcycle-web to version 6.20.1 or later to implement proper object-level authorization for incident operations.
• Audit application access logs for anomalous patterns of PUT requests to /api/incidents/ targeting multiple sequential or disparate ID values from single accounts.