---
id: CVE-2026-121620
title: >-
  CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature
  Verification
summary: >-
  CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication
  vulnerability that allows unauthenticated attackers to forge Zelty webhook
  events because the x-zelty-hmac-sha256 HMAC signature is never verified.
  Attackers c…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-345
vendor: CoopCycle
product: coopcycle-web
affected:
  - coopcycle-web >= 5.6.0 < 6.20.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T18:48:16.550535Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:48:30.249Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121620'
references:
  - url: >-
      https://github.com/coopcycle/coopcycle-web/commit/9b499950d433ca8ba894996d6b17f49885ca9485
  - url: 'https://github.com/coopcycle/coopcycle-web/releases/tag/v6.20.0'
    label: coopcycle-web v6.20.0 Release Notes
  - url: >-
      https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/config/packages/security.yaml#L328-L330
  - url: >-
      https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Integration/Zelty/ZeltyCatalogProcessor.php#L51-L57
  - url: >-
      https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-5.6.0-before-6.20.0-missing-zelty-webhook-signature-verification
    label: >-
      VulnCheck Advisory: CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing
      Zelty Webhook Signature Verification
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.498Z'
---

## Overview

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

## Affected

- `coopcycle-web >= 5.6.0 < 6.20.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.