CVE-2026-59967

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting createdby to the requesting user when an authenticated member of a shared Space...

CVE-2026-59967

Prior to version 2.6.10 , Tandoor Recipes is vulnerable to a Cross-user IDOR in the /api/recipe-from-source/ endpoint. The application fails to restrict the created_by field when looking up a BookmarkletImport by its sequential primary key within a shared Space. An authenticated member can submit...

PT-2026-115665

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created by to the requesting user when an authenticated member of a shared Space...