Vendor
CoopCycle coopcycle-web before version 6.20.1 contains a broken access control vulnerability in its incident management API that allows authenticated couriers to unauthorizedly modify or cancel orders and tasks belonging to other stores.