A missing authentication check allows attackers to forge secure webhook events. The application ignores the x-zelty-hmac-sha256 HMAC signature, meaning that any user can POST arbitrary dish, menu, option, or order-status data to the /api/zelty/webhook/* endpoints. When these events are accepted, the attacker can toggle restaurant products on or off, create or delete menu items, and alter the state of orders, effectively commandeering the service and potentially causing financial or operational damage.

The product affected is CoopCycle coopcycle-web. Versions from 5.6.0 up to, but not including, 6.20.0 contain the flaw; all later releases have applied the fix and properly verify the signature.

The assigned CVSS score of 8.3 reflects a high‑severity vulnerability. The EPSS score is currently not available, and it is not listed in the CISA KEV catalog. Because the vulnerability involves a simple HTTP POST request to a publicly exposed endpoint, an attacker can exploit it without prior authorization, using standard network tools. The attack vector is network, and exploitation requires no special credentials or privileged access, making the risk high for any instance exposing the webhook endpoint.