CVE-2026-59967: medium-severity vulnerability in TandoorRecipes recipes
Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.3%
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Affected products
TandoorRecipes · recipesRelated CVEs — TandoorRecipes recipes
In the same product, most dangerous first.
CVE-2025-23211CRITICALTandoor Recipes - SSTI - Remote Code ExecutionEPSS 3.7%CVE-2025-23212HIGHTandoor Recipes - Local file disclosure - Users can read the content of any file on the serverEPSS 0.5%CVE-2026-33152CRITICALTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationEPSS 0.5%CVE-2026-25964MEDIUMTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadEPSS 0.5%CVE-2026-33148MEDIUMURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyEPSS 0.5%CVE-2026-33153HIGHTandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control LogicEPSS 0.5%