CVE-2026-121620
Received Received - Intake

Authentication Bypass in CoopCycle Webhook Handling

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121620
EUVD
EUVD-2026-116906

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
CoopCycle coopcycle-web 5.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication flaw in CoopCycle coopcycle-web versions 5.6.0 through 6.19.1. The application fails to verify the x-zelty-hmac-sha256 HMAC signature for Zelty webhook events, allowing unauthenticated attackers to forge these events. Attackers can send crafted POST requests to endpoints like /api/zelty/webhook/* to manipulate dish, menu, option, and order-status events, potentially toggling restaurant products or altering order preparation states without authorization.

Detection Guidance

Check if your CoopCycle instance is running a vulnerable version (5.6.0 to 6.19.1) by inspecting the version in your deployment or logs. Monitor webhook endpoints like /api/zelty/webhook/* for unexpected POST requests with forged dish, menu, option, or order-status events. Verify if the ZELTY_WEBHOOK_SECRET is configured in your .env file and if signature verification is enabled in the security configuration.

Impact Analysis

Unauthenticated attackers could forge webhook events to manipulate restaurant products or alter order preparation states. This could lead to unauthorized changes in menu items, dish availability, or order statuses, potentially disrupting restaurant operations or causing incorrect order fulfillment. The lack of signature verification means there is no way to confirm the authenticity of incoming webhook events.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized manipulation of restaurant products and order states. Unauthenticated webhook forgery may lead to unauthorized data changes, compromising data integrity and security. GDPR requires data integrity and security measures, while HIPAA mandates strict access controls for health-related data. The lack of authentication in webhook processing undermines these requirements.

Mitigation Strategies
  • Upgrade CoopCycle to version 6.20.0 or later to enable HMAC signature verification for Zelty webhooks.
  • Ensure ZELTY_WEBHOOK_SECRET is set in your .env file and not left empty, as this is required for signature validation.
  • Review firewall rules to restrict access to /api/zelty/webhook/* endpoints to trusted sources only.
  • Monitor webhook logs for unauthorized POST requests or unusual activity indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...