Insecure API Endpoint in Tandoor Recipes Affects User Data Privacy

CVE-2026-59967

What is CVE-2026-59967?

An API vulnerability in Tandoor Recipes allows authenticated users to exploit the BookmarkletImport feature, enabling them to access and delete another user's pending data submissions. Specifically, when a member of a shared Space sends a request to the '/api/recipe-from-source/' endpoint with another member's bookmarklet identifier, the system processes this without adequate authorization checks. This results in unauthorized disclosure of sensitive captured page content and the unintentional deletion of the target user's pending imports. The issue has been remedied in version 2.6.10, which reinforces the necessary access controls.

References