Improper Access Control in Tandoor Recipes Application

CVE-2026-59963

What is CVE-2026-59963?

The Tandoor Recipes application has a vulnerability where certain recipe utility endpoints fail to enforce object-level authorization checks. This oversight allows authenticated users within a shared Space to access and manipulate private recipe objects using identifiers intended for another user. Specifically, the api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, and api/share-link/ endpoints can be exploited to disclose private recipe files or create public links without proper permissions. This flaw can lead to the exposure of sensitive data to unauthorized users and external services. The issue has been rectified in version 2.6.10.

References