{"id":"CVE-2026-121945","title":"CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint","summary":"CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incide…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"CoopCycle","product":"coopcycle-web","affected":["coopcycle-web < 6.20.1"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T18:44:21.765480Z"},"exploitAvailable":true,"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T18:44:49.046Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121945","references":[{"url":"https://github.com/coopcycle/coopcycle-web/issues/5390"},{"url":"https://hackmd.io/@hieund/coopcycle-incident-courier-cross-tenant-bola"},{"url":"https://github.com/coopcycle/coopcycle-web/commit/d997393d128afa1febe34e8f295b9511c12d19a0"},{"url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Entity/Incident/Incident.php#L43-L71"},{"url":"https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-before-6.20.1-idor-via-incident-resource-and-action-endpoint","label":"VulnCheck Advisory: CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-11-05T21:36:00.495Z","slug":"CVE-2026-121945","body":"## Overview\n\nCoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks.\n\n## Affected\n\n- `coopcycle-web < 6.20.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}