CoopCycle - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/coopcycle/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 14:47:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCoopCycle coopcycle-web: Broken access control in incident management (CVE-2026-121945)https://feed.craftedsignal.io/briefs/2026-11-coopcycle-access-control/Wed, 04 Nov 2026 14:47:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-coopcycle-access-control/CoopCycle coopcycle-web before version 6.20.1 contains a broken access control vulnerability in its incident management API that allows authenticated couriers to unauthorizedly modify or cancel orders and tasks belonging to other stores.CoopCycle coopcycle-web before version 6.20.1 contains a broken access control vulnerability within its incident management system. The application improperly authorizes requests by only verifying the presence of the ROLE_COURIER role, failing to validate ownership or scope of the requested incident. This allows an authenticated courier to read and modify sensitive incident data across the platform.

Impact

Unauthorized actors can enumerate incident IDs and manipulate system state by issuing PUT requests to the /api/incidents/{id}/action endpoint. Documented impacts include the ability to re-price, cancel, or reschedule orders and tasks belonging to other stores.

Recommendation

  • Upgrade coopcycle-web to version 6.20.1 or later to implement proper object-level authorization for incident operations.
  • Audit application access logs for anomalous patterns of PUT requests to /api/incidents/ targeting multiple sequential or disparate ID values from single accounts.
]]>highadvisory