This vulnerability is a broken access control flaw in CoopCycle's coopcycle-web application. Any authenticated courier can read or modify every incident instance, because the system only enforces a generic ROLE_COURIER check and does not verify ownership. Attackers can enumerate incident identifiers sequentially and issue HTTP PUT requests to the /api/incidents/{id}/action endpoint to change pricing, cancel, or reschedule orders belonging to other stores. The flaw meets CWE-639: Permission Missing. The impact is that a malicious courier could alter or invalidate other stores’ orders, causing financial loss and service disruption.

Affected products are CoopCycle coopcycle-web versions earlier than 6.20.1. This includes all releases up to and including v6.19.1. No other vendor or product is listed.

The CVSS score is 7.2, indicating a high but not critical severity. EPSS data are not available, so the exploitation probability cannot be quantified. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires authenticated access as a courier and the ability to guess or enumerate incident IDs, a task that can be performed via automated scripts. An attacker with these capabilities could potentially compromise the integrity of order management for all affected stores. Monitoring for unusual activity on the /api/incidents endpoint and listening for ACL violations should be considered.