Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE

Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows command execution via recipe steps. id: CVE-2025-23211 info: name: Tandoor Recipes 1.5.24 - Jinja2 SSTI RCE author: sammiee5311 severity: critical description: | Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows...

CVE-2026-59963

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies...

CVE-2026-59970

Prior to version 2.6.10 , Tandoor Recipes is vulnerable to a Blind Server-Side Request Forgery (SSRF) via the AI provider URL (api_base ). An authenticated user can configure an AI provider with a URL targeting internal addresses; when an AI action is invoked, the application passes this URL to L...

CVE-2026-61726

The Tandoor Recipes application (prior to version 2.6.12 ) contains an authorization bypass in the StepViewSet and IngredientViewSet components. The root cause is that these components filter by active Space and use role-level CustomIsUser checks without verifying private-recipe ownership or shar...

EUVD-2026-103143

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub without complexity validation or an execution timeout when an authenticated user stores a...

CVE-2026-59966 Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub without complexity validation or an execution timeout when an authenticated user stores a...

CVE-2026-59966

Prior to version 2.6.10 , Tandoor Recipes is vulnerable to a Regular Expression Denial of Service (ReDoS) . The application executes user-controlled Automation regular-expression patterns using Python's re.sub() without complexity validation or execution timeouts. An authenticated user can store ...

EUVD-2026-103142

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies...

CVE-2026-59963 Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies...

CVE-2026-59963

In Tandoor Recipes versions prior to 2.6.10 , an authorization bypass exists in several recipe utility API endpoints, including api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, and api/share-link/. The root cause is a failure to invoke private-recipe owner or sharing permission ...

CVE-2026-59962

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sortorder and orderfield strings into Django ORM orderby calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or...

CVE-2026-59967

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting createdby to the requesting user when an authenticated member of a shared Space...

CVE-2026-59962

Prior to version 2.6.10 , the Tandoor Recipes application is vulnerable to an ORM ORDER BY Injection via foreign-key traversal. The application fails to validate sort_order and order_field strings passed into Django ORM order_by() calls during recipe searches, RecipeBook actions, or via CustomFil...

CVE-2026-59967

Prior to version 2.6.10 , Tandoor Recipes is vulnerable to a Cross-user IDOR in the /api/recipe-from-source/ endpoint. The application fails to restrict the created_by field when looking up a BookmarkletImport by its sequential primary key within a shared Space. An authenticated member can submit...

PT-2026-116140

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub without complexity validation or an execution timeout when an authenticated user stores a...

PT-2026-115665

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created by to the requesting user when an authenticated member of a shared Space...

PT-2026-115664

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort order and order field strings into Django ORM order by calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, ...

PT-2026-116142

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

PT-2026-116139

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies...

PT-2026-116141

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.10 Description An authenticated user can trigger a Server-Side Request Forgery SSRF by creating a Space and configuring an AI provider with a URL targeting an internal address. When an AI action is invoked...