Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
Published: 2026-10-16
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data disclosure and deletion
Action: Apply Patch
AI Analysis

Impact

Tandoor Recipes is a web application for recipe management. Before version 2.6.10, its POST /api/recipe-from-source/ endpoint allowed an authenticated member of a shared Space to supply the primary key of another member’s pending BookmarkletImport. The endpoint returned the stored URL and captured page content and then unconditionally deleted that import. This insecure direct object reference (CWE‑639) lets a user read private captured page information and delete another user’s pending import, without any remote code execution or denial‑of‑service side effects.

Affected Systems

The vulnerability affects the TandoorRecipes:recipes application in any release older than 2.6.10. The issue was fixed in the 2.6.10 release, so installations running that version or newer are not impacted.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity. Exploitation requires valid authentication to a shared workspace, making the attack vector internal or victim‑dependent. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. An attacker with credentials can obtain private captured content and remove a colleague’s pending import, which represents a moderate‑risk data‑access compromise for the affected workspace.

Generated by OpenCVE AI on October 16, 2026 at 20:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Tandoor Recipes 2.6.10 or later, which enforces ownership checks on the bookmarklet import API.
  • Restrict shared‑workspace permissions so that only trusted members can submit or manage bookmarklet imports; audit and delete any pending imports that belong to other users.
  • Educate administrators and users not to share bookmarklet import identifiers outside their own workspace and monitor API activity for anomalous import‑deletion patterns.

Generated by OpenCVE AI on October 16, 2026 at 20:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Tandoorrecipes
Tandoorrecipes recipes
Vendors & Products Tandoorrecipes
Tandoorrecipes recipes

Fri, 16 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
Title Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Tandoorrecipes Recipes
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-19T12:47:26.855Z

Reserved: 2026-07-07T18:49:15.608Z

Link: CVE-2026-59967

cve-icon Vulnrichment

Updated: 2026-10-19T12:47:19.859Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T17:17:35.507

Modified: 2026-10-19T13:16:58.300

Link: CVE-2026-59967

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T18:00:10Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key