Django ORM Vulnerability in Tandoor Recipes Affecting User Data

CVE-2026-59962

What is CVE-2026-59962?

A vulnerability exists in Tandoor Recipes prior to version 2.6.10, where unvalidated input strings for sorting are passed into Django ORM calls. This can lead to unauthorized exposure of sensitive user data, such as password hashes, email addresses, and administrator status. The flaw arises when authenticated users exploit foreign-key traversal paths during recipe searches and custom filter ordering. By sending crafted requests to the API endpoints, attackers can manipulate the ordering fields, causing the application to inadvertently reveal associated User field values. The issue has been addressed in the release of version 2.6.10, which mitigates this risk.

References