CVE-2026-59962: Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sortorder and orderfield strings into Django ORM orderby() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses finalizeordering and orderby through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tandoor Recipesto a version that resolves this vulnerability.Fixed in 2.6.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it remotely with low complexity. No user interaction is required.
Which interfaces and ordering settings are affected?
The affected request paths are 8080/api/recipe/ and 8080/api/recipe-book/. Vulnerable ordering can be supplied through recipe search, RecipeBook, or stored CustomFilter ordering values.
What information could be exposed?
Observable result ordering can be used to infer values from related User records, including password hashes, email addresses, administrator status, and other related database values. The issue affects confidentiality; no integrity or availability impact is stated.
Are default deployments affected?
The provided information does not identify a configuration prerequisite beyond having an authenticated account and an affected version. Versions prior to 2.6.10 are affected.
How should teams remediate this?
Upgrade Tandoor Recipes to version 2.6.10, which fixes the issue. If upgrading cannot happen immediately, restrict access for untrusted authenticated users because authentication is the stated prerequisite for exploitation.