coopcycle-web vulnerabilities
1 known vulnerability in coopcycle-web from CoopCycle. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
1vulnerabilities
0critical
1high
0exploited
7.6average CVSS score
Latest first
- 7.6 High severity
coopcycle-web: Authorization Bypass Through User-Controlled Key
CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api