CVE-2026-59967: Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting createdby to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tandoor Recipesto a version that resolves this vulnerability.Fixed in 2.6.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is a member of a shared Space can exploit it against another member of that same active Space. The attacker needs to submit the other member's pending BookmarkletImport identifier to the POST /api/recipe-from-source/ endpoint.
What information or data can be affected?
The endpoint can return the victim's stored URL and captured page content, which may include authenticated or private content captured by the bookmarklet. It also deletes the victim's pending BookmarkletImport after processing it.
Are installations affected by default?
The issue affects versions prior to 2.6.10 when users share a Space and have pending bookmarklet imports. Exploitation requires an authenticated Space member rather than an unauthenticated remote user.
How can we determine whether exposure may have occurred?
Review requests to POST /api/recipe-from-source/ for use of pending BookmarkletImport identifiers belonging to a different member of the active Space. Unexpectedly missing pending imports for Space members may also indicate that an import was deleted.
What is the remediation?
Upgrade Tandoor Recipes to version 2.6.10, which fixes the issue. Until then, limit shared-Space membership to trusted users and avoid leaving sensitive bookmarklet captures pending.