# CVE-2026-59963: Tandoor Recipes authorization bypass in recipe utility endpoints

Source: https://junglewise.ai/threats/cve-2026-59963-tandoor-recipes-is-an-application-for-managing-recipes-planning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-59963 · Severity: high · CVSS 7.1 · Published 2026-10-16

Tandoor Recipes is a recipe management application that helps users organize recipes, plan meals, and create shopping lists. Prior to version 2.6.10, members of a shared workspace could access other users' private recipes and sensitive content by providing recipe identifiers to AI import, file export, external link, and sharing endpoints, potentially exposing private recipes to other workspace members and external AI services.

Technologies: [Tandoor Recipes Recipes](https://junglewise.ai/threats/technologies/tandoor-recipes-recipes). Vendors: [Tandoor Recipes](https://junglewise.ai/threats/vendors/tandoor-recipes).

## Quick answers

**Is CVE-2026-59963 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59963 being exploited in the wild.

**How severe is CVE-2026-59963?** High severity, with a CVSS score of 7.1, published 16 October 2026.

**Which products and versions are affected?** Tandoor Recipes Recipes before 2.6.10.

**Is there a fix for CVE-2026-59963?** Yes: fixed in 2.6.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59963 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-59963?** Check whether you run Tandoor Recipes Recipes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.6.10

## Technical details

Multiple API endpoints (ai-import, get_recipe_file, get_external_file_link, share-link) fail to enforce object-level authorization checks when retrieving private recipe objects from a shared Space, allowing an authenticated user to bypass permission controls by supplying another member's private recipe ID. The vulnerability affects CustomRecipePermission validation and can result in private recipe file contents being sent to configured external AI providers or being accessible via public share links.

## Affected products

- Tandoor Recipes Recipes before 2.6.10

## Timeline

- 2026-10-16: disclosed
- 2026-10-16: patched

## References

- [https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4](https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4)
- [https://github.com/TandoorRecipes/recipes/commit/8b4a4c06902d024609d7376b6c45f5ea4f9bed07](https://github.com/TandoorRecipes/recipes/commit/8b4a4c06902d024609d7376b6c45f5ea4f9bed07)

## Related threats

- [Tandoor Recipes improper cache-key design privilege escalation](https://junglewise.ai/threats/cve-2026-112342-tandoor-recipes-before-2-7-0-contains-an-improper-cache-key)
- [Tandoor Recipes server-side request forgery in Pestle importer](https://junglewise.ai/threats/cve-2026-115810-tandoor-recipes-before-2-7-0-contains-a-server-side-request)