CVE-2026-59963

Tandoor Recipes before 2.6.12 allows an authenticated user with read and write API scope in the victim's Space to access and modify another same-Space member's private recipe steps. The flaw is because StepViewSet and IngredientViewSet filter only by active Space and use role-level checks instead of the private-recipe owner or sharing predicate.

Tandoor Recipes before 2.6.10 passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks. An authenticated user can create a Space, configure an AI provider with a URL targeting an internal address, and invoke an AI action, enabling scanning of internal hosts and ports.

Tandoor Recipes prior to version 2.6.10 executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout. When an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe, the automation engine can occupy a Gunicorn worker until its request timeout, exhausting worker slots and making the service unavailable.

In Tandoor Recipes prior to 2.6.10, the application looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. The endpoint returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import.

In Tandoor Recipes prior to 2.6.10, unvalidated sort_order and order_field strings are passed into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields.

Tandoor Recipes is a recipe manager that can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration (SQLite and default MEDIA_ROOT), the full database file may be externally accessible, potentially on the Internet, because the db.sqlite3 file is created in the same directory as MEDIA_ROOT.