CVE-2026-59962 Details
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
An order injection vulnerability has been identified in Tandoor Recipes versions prior to 2.6.10. The issue allows authenticated users to manipulate Django ORM order_by() calls by injecting unvalidated sort_order and order_field parameters. This exploitation can lead to unauthorized access to sensitive information, such as password hashes and email addresses, from related User database fields. The vulnerability arises from the lack of proper validation on ordering parameters, enabling foreign-key traversal that leaks confidential data through observable changes in result ordering.
Users can update to Tandoor Recipes version 2.6.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-4x57-2q4q-xwpp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/TandoorRecipes/recipes/commit/322696f618997e98f2d4c15ec64b9480735589f0 | [email protected] | Source CodeVendor |
| https://github.com/TandoorRecipes/recipes/commit/382a976cc79635edc30aef84cb2b2b72eb8afd3c | [email protected] | Source CodeVendor |
| https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4 | [email protected] | Source CodeVendor |
| https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10 | [email protected] | Release NotesVendor |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-4x57-2q4q-xwpp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tandoor Recipes | < 2.6.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |