An attacker can influence the ordering logic of the Tandoor Recipes application by sending unsanitized sorting parameters built from foreign‑key traversal paths. When the application passes these values directly to Django’s ORM order_by, the framework interprets double underscores as navigation of related tables. Because the user‑supplied strings are unchecked, the resulting query can expose sensitive columns from the User table, such as password hashes, email addresses, and administrative flags.

Affected deployments run Tandoor Recipes version 2.6.9 or earlier on the API endpoints 8080/api/recipe/ and 8080/api/recipe‑book/. The vulnerability exists in the core application code that processes recipe search, RecipeBook views, and custom filter ordering. Any instance that accepts authenticated user requests to these paths is vulnerable until the code is updated to version 2.6.10 or later, where the ordering parameters are sanitized.

The CVSS score of 6.5 classifies the weakness as a Medium severity information‑disclosure flaw. No EPSS value is published, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated user and relies on the application’s API. If an attacker can supply a crafted order_field value that traverses foreign keys, the query will leak database values. The lack of authentication bypass or privilege escalation limits the impact to information disclosure for the victim’s own account and other users referenced by the traversal. Immediate patching is therefore strongly recommended.