CVE-2026-121620

CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

8.3 High

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: Low

Exploit likelihood

0.22%Unchanged since Nov 5, 2026

What each source reports

CVE List Score used 8.3

CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

Record: CVE-2026-121620
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-345
Updated: 2026-11-04

EUVDEUVD-2026-116906 8.3

Record: EUVD-2026-116906
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Updated: 2026-11-04

GitHub AdvisoriesGHSA-fffc-w3w6-p7qp 8.3

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that...

Record: GHSA-fffc-w3w6-p7qp
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-345
Updated: 2026-11-04

NVD 8.3

Record: CVE-2026-121620
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-345
Updated: 2026-11-04

OSV 8.3

CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

Record: CVE-2026-121620
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness: CWE-345
Updated: 2026-11-05

Affected products

coopcycle coopcycle-web

History

History
Recorded	Changed	Sources
Nov 5, 2026	references	CVE List, EUVD, NVD, OSV
Nov 4, 2026	published	EUVD
Nov 4, 2026	published	EUVD, NVD
Nov 4, 2026	aliases, references	GitHub Advisories
Nov 4, 2026	aliases, published	EUVD
Nov 4, 2026	first indexed	CVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-121620 is a high vulnerability (CVSS 8.3) in Coopcycle Coopcycle-web, published November 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.