Executive brief
Mealie is a self-hosted recipe manager and meal planner. An authenticated attacker can view other users' recipe ratings, favorite recipes, and private recipe identifiers by manipulating user IDs in API requests, bypassing access controls that should restrict viewing to the user's own data.
Technical details
The ratings and favorites API endpoints in Mealie before 3.21.0 fail to validate that the requesting user owns the data being accessed. An authenticated attacker can enumerate arbitrary user IDs in the URL path to retrieve other users' recipe ratings and favorites across different groups or households. No special privileges or user interaction is required beyond valid authentication.
Affected products
- Mealie Mealie before 3.21.0
Timeline
- 2026-09-18: disclosed