Live › vulnerability › CVE-2026-59962
Go to dashboardTandoor Recipes passes unvalidated sort order strings into Django order_by() calls, so an authenticated user can traverse foreign keys with double-underscore paths. Observable result ordering lets that user infer related User values such as password hashes, email addresses and administrator status.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Instances of Tandoor Recipes running a version before 2.6.10 where users with a login can reach recipe search, RecipeBook ordering or saved CustomFilter ordering. Instances where only trusted administrators hold accounts face a much smaller risk.
No product ranges from the sources yet.
2.6.10 are affected.2.6.10 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-59962")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.