Threats tagged 'ghsa-8jxw-hq6x-qqhf'

CoopCycle coopcycle-web versions before 6.20.1 have a broken access control vulnerability that allows any courier user to read and modify all incident records. The flaw arises because incident operations only verify the ROLE_COURIER role without further authorization checks. Attackers can enumerate incident IDs and use the PUT /api/incidents/{id}/action endpoint to alter orders and tasks belonging to other stores, including repricing, canceling, or rescheduling them.