CVE-2026-59962
MediumCVSS 6.5Summary
In Tandoor Recipes prior to 2.6.10, unvalidated sort_order and order_field strings are passed into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields.
Risk Assessment
An attacker can infer password hashes, email addresses, administrator status, and other related database values.
Recommendation
Upgrade Tandoor Recipes to version 2.6.10, where this issue is fixed.
Other vulnerabilities in Tandoor Recipes
See all- CVE-2026-59967Medium
In Tandoor Recipes prior to 2.6.10, the application looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. The endpoint returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import.
- CVE-2026-23838High
Tandoor Recipes is a recipe manager that can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration (SQLite and default MEDIA_ROOT), the full database file may be externally accessible, potentially on the Internet, because the db.sqlite3 file is created in the same directory as MEDIA_ROOT.
Original NVD description (English source)
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS