Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-121620CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

Medium 6.5

In plain English

A medium-severity insufficient verification of data authenticity in coopcycle-web from CoopCycle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

Affected products (as reported)

Vendor	Product	Versions
CoopCycle	coopcycle-web	5.6.0 – before 6.20.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/coopcycle/coopcycle-web/commit/9b499950d433ca8ba894996d6b17f49885ca9485 patch
coopcycle-web v6.20.0 Release Notes release-notes
https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/config/packages/security.yaml#L328-L330 technical-description
https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Integration/Zelty/ZeltyCatalogProcessor.php#L51-L57 technical-description
VulnCheck Advisory: CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification third-party-advisory