CVE-2026-121945

CoopCycle coopcycle-web versions before 6.20.1 are vulnerable to a broken access control vulnerability. The issue exists because incident operations only verify the ROLE_COURIER permission, allowing any courier to access all incidents. An attacker can enumerate sequential incident IDs and utilize...