CyberSecBulletin

CoopCycle vulnerabilities

We track 1 vulnerability in CoopCycle products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.

1vulnerabilities
0critical
1high
0exploited
7.6average CVSS score

Latest CoopCycle vulnerabilities

  • 7.6 High severity

    coopcycle-web: Authorization Bypass Through User-Controlled Key

    CVE-2026-121945CoopCycle

    CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api