{"id":"CVE-2026-59962","kind":"vulnerability","aliases":["CVE-2026-59962"],"related":[],"title":"Tandoor Recipes: ordering parameters leak related user fields to logged-in users","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.","summary":"Tandoor Recipes passes unvalidated sort order strings into Django order_by() calls, so an authenticated user can traverse foreign keys with double-underscore paths. Observable result ordering lets that user infer related User values such as password hashes, email addresses and administrator status.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["django","package","self-hosted","tandoor-recipes"],"not_affected_if":["auth-required","patched-version"],"how_to_check":"- Check the installed Tandoor Recipes version; versions before `2.6.10` are affected.\n- Confirm whether untrusted or self-registered users can log in to the instance.","fix":"- Upgrade Tandoor Recipes to `2.6.10` or later.\n- Until upgraded, restrict who holds accounts on the instance.","status":"open","published_at":"2026-10-16T17:17:35+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:57:47+00:00","updated_at":"2026-10-25T03:57:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:57:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Tandoor Recipes to `2.6.10` or later.\n- Until upgraded, restrict who holds accounts on the instance.","reach":"internet","title":"Tandoor Recipes: ordering parameters leak related user fields to logged-in users","impact":"medium","summary":"Tandoor Recipes passes unvalidated sort order strings into Django order_by() calls, so an authenticated user can traverse foreign keys with double-underscore paths. Observable result ordering lets that user infer related User values such as password hashes, email addresses and administrator status.","category":"package","nicknames":[],"who_cares":["tandoor-recipes","self-hosted","django"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated user infers password hashes and admin status of other accounts","analyst_note":"","how_to_check":"- Check the installed Tandoor Recipes version; versions before `2.6.10` are affected.\n- Confirm whether untrusted or self-registered users can log in to the instance.","needs_analyst":false,"not_affected_if":["auth-required","patched-version"],"who_is_affected":"Instances of Tandoor Recipes running a version before 2.6.10 where users with a login can reach recipe search, RecipeBook ordering or saved CustomFilter ordering. Instances where only trusted administrators hold accounts face a much smaller risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3460,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-59962':16A,19A '2.6.10':88C,180C '8080/api/recipe':131C '8080/api/recipe-book':133C 'address':68B,166C 'administr':70B,167C 'applic':76C 'attack':135C 'authent':42B,105C 'build':83C 'call':39B,102C 'customfilt':119C 'cve':14A,17A 'databas':172C 'django':20B,36B,98C,138C 'doubl':50B,141C 'double-underscor':49B,140C 'email':67B,165C 'field':8A,95C,144C,159C 'final':125C 'fix':177C 'foreign':46B,109C 'foreign-key':108C 'hash':66B,164C 'host':24B 'infer':59B,162C 'interpret':139C 'issu':175C 'key':47B,110C 'leak':5A,154C 'let':56B 'list':85C 'log':11A 'logged-in':10A 'manag':78C 'meal':81C 'observ':53B,151C 'order':3A,33B,37B,55B,92C,94C,100C,120C,126C,128C,143C,153C 'orm':99C 'packag':21B 'paramet':4A 'pass':30B,89C 'password':65B,163C 'path':52B,112C 'plan':80C 'prior':86C 'process':123C 'recip':2A,27B,29B,73C,79C,114C 'recipebook':116C 'relat':6A,60B,147C,157C,171C 'related-t':146C 'request':122C 'result':54B,152C 'search':115C 'self':23B 'self-host':22B 'shop':84C 'sort':32B,91C 'status':71B,168C 'store':118C 'string':34B,96C 'suppli':107C 'tabl':148C 'tandoor':1A,26B,28B,72C 'tandoor-recip':25B 'travers':45B,111C,149C 'underscor':51B,142C 'unvalid':31B,90C 'use':124C 'user':7A,13A,43B,58B,61B,106C,158C 'valu':62B,121C,155C,173C 'version':179C 'work':136C","nicknames":[],"mitigations":[],"who_affected":"Instances of Tandoor Recipes running a version before 2.6.10 where users with a login can reach recipe search, RecipeBook ordering or saved CustomFilter ordering. Instances where only trusted administrators hold accounts face a much smaller risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59962","severity":null,"published_at":"2026-10-16T17:17:35+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}