CVE-2026-59967
Received Received - Intake

Insecure Direct Object Reference in Tandoor Recipes

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-59967
EUVD
EUVD-2026-102948

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TandoorRecipes recipes < 2.6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59967 is an Insecure Direct Object Reference (IDOR) vulnerability in Tandoor Recipes affecting the /api/recipe-from-source/ endpoint. It allows authenticated users in a shared Space to access or delete another member's pending bookmarklet import by manipulating an integer ID parameter. The endpoint fails to restrict access to the requesting user's objects, enabling unauthorized data exposure and data destruction.

Detection Guidance

To detect this vulnerability, check if your Tandoor Recipes instance is running a version prior to 2.6.10. Review logs for unauthorized access attempts to the /api/recipe-from-source/ endpoint with bookmarklet parameters. Look for deleted pending imports or unexpected data exposure in shared Spaces.

Impact Analysis

This vulnerability can lead to unauthorized access to private or sensitive data such as captured URLs and HTML content from other users' bookmarklet imports. Additionally, it allows attackers to silently delete another user's pending imports without consent, potentially disrupting workflows and causing data loss within shared Spaces.

Mitigation Strategies

Immediately upgrade Tandoor Recipes to version 2.6.10 or later. If upgrading is not possible, restrict access to the /api/recipe-from-source/ endpoint and audit all bookmarklet imports for unauthorized deletions or data leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59967. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart