CVE-2026-59963: Tandoor Recipes Information Disclosure Flaw

CVE-2026-59963 Overview

CVE-2026-59963 is an Insecure Direct Object Reference (IDOR) vulnerability in Tandoor Recipes, an application for managing recipes, planning meals, and building shopping lists. Versions prior to 2.6.10 fail to enforce object-level authorization on several recipe utility endpoints. Authenticated members of a shared Space can supply another member's private recipe identifier to the api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, and api/share-link/ endpoints. The endpoints then read private recipe files, forward file bytes to the configured AI provider, or create disclosure links without checking CustomRecipePermission. The flaw is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated same-Space users can read private recipe files, exfiltrate uploaded content to external AI providers, and generate public share links for recipes they do not own.

Affected Products

Tandoor Recipes versions prior to 2.6.10
Deployments with Space sharing enabled (public link creation path)
Instances with configured external AI providers (data leakage path)

Discovery Timeline

2026-10-16 - CVE-2026-59963 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-59963

Vulnerability Analysis

Tandoor Recipes exposes multiple recipe utility endpoints that accept a recipe_id from the authenticated caller. The handlers resolve the referenced Recipe object scoped only to the user's Space, not to the recipe's owner or sharing policy. As a result, any authenticated member of a shared Space can target another member's private recipe by its identifier. The affected endpoints then perform privileged actions on the targeted recipe: streaming the underlying file, submitting file bytes to the configured AI provider through api/ai-import/, generating external file links through api/get_external_file_link/, or creating a public share URL through api/share-link/ when Space sharing is enabled. Private uploads can leak to both internal users and configured third-party services. This is a classic broken object-level authorization issue [CWE-639].

Root Cause

The handlers invoke Recipe.objects.filter(...) using the attacker-supplied recipe_id and operate on the result without calling CustomRecipePermission().has_object_permission(...). Space membership was treated as sufficient authorization, bypassing the private-recipe owner and sharing checks.

Attack Vector

An authenticated user who shares a Space with the victim issues a POST or GET request to one of the vulnerable endpoints with the victim's private recipe_id. No elevated privileges, user interaction, or network pivot is required beyond standard Space membership.

python

# Patch applied in cookbook/views/api.py (commit 8b4a4c0)
if serializer.validated_data['recipe_id']:
    if recipe := Recipe.objects.filter(id=serializer.validated_data['recipe_id']).first():
        # check permissions
        if not CustomRecipePermission().has_object_permission(request, self, recipe):
            raise PermissionDenied()

        if recipe.file_path:
            uploaded_file = get_recipe_provider(recipe).get_file(recipe)

Source: TandoorRecipes/recipes commit 8b4a4c0. The fix inserts an explicit CustomRecipePermission object-level check before any file read, AI submission, or link creation runs.

Detection Methods for CVE-2026-59963

Indicators of Compromise

Requests to api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, or api/share-link/ where the recipe_id resolves to a recipe owned by a different user in the same Space.
Unexpected outbound traffic from Tandoor Recipes to the configured AI provider referencing recipes the requesting user did not create.
Creation of public share links in api/share-link/ by users who are not the recipe owner.

Detection Strategies

Correlate application logs linking the request user, the targeted recipe_id, and the recipe owner; flag mismatches on the four affected endpoints.
Review AI provider request logs for file submissions whose source recipe owner differs from the submitting user.
Audit the Tandoor ShareLink or equivalent table for links created by non-owner Space members prior to the patch.

Monitoring Recommendations

Enable verbose Django request logging for cookbook/views/api.py endpoints and ship events to a centralized log platform.
Alert on sudden spikes in api/share-link/ creation when Space sharing is enabled.
Baseline normal AI import volume per user and alert on deviations.

How to Mitigate CVE-2026-59963

Immediate Actions Required

Upgrade Tandoor Recipes to version 2.6.10 or later, which introduces the CustomRecipePermission object-level check on the affected endpoints.
Audit existing public share links and revoke any that were created by non-owner Space members.
Review AI provider logs for private recipe content that may have been transmitted prior to patching.

Patch Information

The fix is published in Tandoor Recipes 2.6.10 and detailed in GitHub Security Advisory GHSA-cqj3-64qw-4w52. Core changes land in commits 82fd4e0 and 8b4a4c0.

Workarounds

Disable Space sharing until the upgrade is complete to eliminate the api/share-link/ public disclosure path.
Restrict Space membership to trusted users and remove shared Spaces that contain sensitive private recipes.
Temporarily disable the configured external AI provider integration to prevent file bytes from reaching third parties.

bash

# Upgrade using Docker Compose
docker compose pull
docker compose down
# Pin image to the fixed release in docker-compose.yml:
#   image: vabene1111/recipes:2.6.10
docker compose up -d