CoopCycle coopcycle-web incident feature lacks per-order checks (IDOR)

Any delivery courier account can change other stores' orders in this app.

Summary

The incident feature in CoopCycle's coopcycle-web checks only that a user is a courier, not who owns the order or task. Any courier can therefore read and change other stores' delivery tasks. Versions before 6.20.1 are affected.

What to do

Update to 6.20.1 or newer.

Products and platforms

CoopCycle coopcycle-web

CVE IDs

CVE-2026-121945 (opens in a new tab)

Sources

Write-up: hackmd.io (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab) · hackmd.io (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 12:31 UTC

First seen 2026-11-09 15:20 UTC