CVE-2026-59967 Details
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
A cross-user insecure direct object reference vulnerability has been identified in the Tandoor Recipes application, specifically in versions prior to 2.6.10. The issue arises in the 'POST /api/recipe-from-source/' endpoint, which imports recipes from a bookmarklet saved by the user. The vulnerability allows an authenticated user to access and delete another user's pending bookmarklet import within the same shared space. This is possible because the endpoint does not properly restrict access based on the user who created the bookmarklet, only the space it belongs to. As a result, an attacker can retrieve private or authenticated content captured by the victim's bookmarklet and destroy their pending import.
Users can update to Tandoor Recipes version 2.6.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-4vw7-c646-g23w | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/TandoorRecipes/recipes/commit/18e13a3493eb7cd7ce309009c5ed2faef5a86ef5 | [email protected] | Source CodeVendor |
| https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10 | [email protected] | Release NotesVendor |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-4vw7-c646-g23w | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tandoor Recipes | <= 2.6.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |