CVE-2026-121620— CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

Quick assessment

Affected

CoopCycle coopcycle-web

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CoopCycle 的版本 5.6.0 至 6.20.0（不含 6.20.0）存在身份验证缺失漏洞。由于系统从未验证头部的 HMAC 签名，未认证的攻击者可伪造 Zelty Webhook 事件。攻击者能够向端点发送伪造的餐品（dish）、菜单（menu）、选项（option）及订单状态（order-status）事件的 POST 请求，从而切换餐厅产品配置并篡改订单制备状态。

CVSS 6.5 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 3 AI

T1571 · Non-Standard Port T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

Source: CVE Program / CVE List V5

Vulnerability Description

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对数据真实性的验证不充分

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
CoopCycle	coopcycle-web	5.6.0 ~ 6.20.0	-

II. Public POCs for CVE-2026-121620

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121620

请登录查看更多情报信息。

Other References for CVE-2026-121620 (5)

https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/config/packages/security.yaml#L328-L330 technical-description
https://github.com/coopcycle/coopcycle-web/commit/9b499950d433ca8ba894996d6b17f49885ca9485 patch
https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Integration/Zelty/ZeltyCatalogProcessor.php#L51-L57 technical-description
https://github.com/coopcycle/coopcycle-web/releases/tag/v6.20.0 release-notes
https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-5.6.0-before-6.20.0-missing-zelty-webhook-signature-verification third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121620

IV. Related Vulnerabilities

Same product: coopcycle-web

CVE-2026-121945
CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Reso

Same vendor: CoopCycle

CVE-2026-121945
CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Reso

Same weakness: CWE-345