Threats affecting pkg:github/coopcycle-web

CoopCycle coopcycle-web versions 5.6.0 up to but not including 6.20.0 have a vulnerability where the HMAC signature on Zelty webhook events is not verified. This allows unauthenticated attackers to forge webhook events that can manipulate restaurant product availability and order preparation states. The issue is fixed in version 6.20.0.

CoopCycle coopcycle-web versions prior to 6.20.1 have an authorization bypass vulnerability that allows any courier user to read and modify all incidents. This occurs because incident operations only verify the ROLE_COURIER role, enabling attackers to enumerate incident IDs and perform unauthorized actions such as repricing, canceling, or rescheduling orders and tasks belonging to other stores.