{"schema":"threatline.record/2","record":{"id":"CVE-2026-59963","aliases":["GHSA-cqj3-64qw-4w52"],"summary":"Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints","details":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.","categories":["Unclassified"],"product":"recipes","vendor":"TandoorRecipes","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-59963","source_modified_at":"2026-10-16T21:16:08.364Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"recipes","vendor":"TandoorRecipes","versions":[{"version":"< 2.6.10","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00212,"percentile":0.10922,"score_date":"2026-10-23"},"published_at":"2026-10-16T19:17:25.148Z","modified_at":"2026-10-16T21:16:08.364Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-59963","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T21:16:08.364Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59963","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-cqj3-64qw-4w52","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/TandoorRecipes/recipes/commit/8b4a4c06902d024609d7376b6c45f5ea4f9bed07","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T19:34:21.929785Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T21:16:08.364Z","content_hash":"9b7132badf9256c244f8d241ce28e9ef74c7408fae65c21625e32d5586e14bc1"}}