Tandoor Recipes vulnerabilities

In Tandoor Recipes prior to 2.6.10, the application looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. The endpoint returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import.

In Tandoor Recipes prior to 2.6.10, unvalidated sort_order and order_field strings are passed into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields.

Tandoor Recipes is a recipe manager that can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration (SQLite and default MEDIA_ROOT), the full database file may be externally accessible, potentially on the Internet, because the db.sqlite3 file is created in the same directory as MEDIA_ROOT.