CVE-2026-59963

Received Received - Intake

Information Disclosure in Tandoor Recipes

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-59963

EUVD

EUVD-2026-103142

Affected Vendors & Products

Vendor	Product	Version / Range
TandoorRecipes	recipes	< 2.6.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Tandoor Recipes before 2.6.10 has an authorization flaw in recipe utility endpoints. When an authenticated user in a shared Space provides another member's private recipe ID, the system processes requests without checking private-recipe ownership or sharing permissions. This allows unauthorized access to private recipes via endpoints like AI import, file retrieval, external links, or share links.

Detection Guidance

Check Tandoor Recipes version for 2.6.10 or higher. Review logs for unauthorized access to private recipes via AI import, file, external-link, or share-link endpoints. Monitor network traffic for unexpected data exfiltration to external services.

Impact Analysis

This vulnerability can expose your private recipe files and sensitive uploaded content to other users in the same shared Space. It may also send your private data to configured external AI services without your consent. The impact includes data leaks within the application and potential unauthorized sharing of private content.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. It may result in non-compliance due to improper handling of private user data and insufficient access controls.

Mitigation Strategies

Upgrade to Tandoor Recipes version 2.6.10 or later. Disable or restrict access to AI import, file, external-link, and share-link endpoints until patched. Review and revoke any unauthorized public or shared links created before the update.

Hi! I’m here to help you understand CVE-2026-59963. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70