CVE-2026-121945

CoopCycle coopcycle-web versions before 6.20.1 are vulnerable to a broken access control vulnerability. The issue exists because incident operations only verify the ROLE_COURIER permission, allowing any courier to access all incidents. An attacker can enumerate sequential incident IDs and utilize...

CVE-2026-121945 CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLECOURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/id/action to re-price, canc...