{"id":"CVE-2026-121620","title":"CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification","summary":"CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers c…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-345"],"vendor":"CoopCycle","product":"coopcycle-web","affected":["coopcycle-web >= 5.6.0 < 6.20.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T18:48:16.550535Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T18:48:30.249Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121620","references":[{"url":"https://github.com/coopcycle/coopcycle-web/commit/9b499950d433ca8ba894996d6b17f49885ca9485"},{"url":"https://github.com/coopcycle/coopcycle-web/releases/tag/v6.20.0","label":"coopcycle-web v6.20.0 Release Notes"},{"url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/config/packages/security.yaml#L328-L330"},{"url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Integration/Zelty/ZeltyCatalogProcessor.php#L51-L57"},{"url":"https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-5.6.0-before-6.20.0-missing-zelty-webhook-signature-verification","label":"VulnCheck Advisory: CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.498Z","slug":"CVE-2026-121620","body":"## Overview\n\nCoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.\n\n## Affected\n\n- `coopcycle-web >= 5.6.0 < 6.20.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}