PT-2026-136965

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/id/action to re-price,...

CVE-2026-121945: CoopCycle coopcycle-web: CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read…

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLECOURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/id/action to re-price, canc...