CVE-2026-59963 Details
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.
A vulnerability exists in Tandoor Recipes versions prior to 2.6.10, allowing authenticated users with normal privileges to bypass access controls for private recipes in shared spaces. This is achieved through several recipe utility API endpoints that fail to enforce proper authorization checks. As a result, users can access, download, or share private recipe files belonging to other users without permission. The vulnerability also allows for the creation of public share links for private recipes, potentially exposing sensitive content to unauthorized users.
Users should update to Tandoor Recipes version 2.6.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4 | [email protected] | Source CodeVendor |
| https://github.com/TandoorRecipes/recipes/commit/8b4a4c06902d024609d7376b6c45f5ea4f9bed07 | [email protected] | Source CodeVendor |
| https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10 | [email protected] | Release NotesVendor |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-cqj3-64qw-4w52 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tandoor Recipes | < 2.6.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |