---
id: "CVE-2026-59962"
kind: "vulnerability"
aliases: ["CVE-2026-59962"]
title: "Tandoor Recipes: ordering parameters leak related user fields to logged-in users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["django", "package", "self-hosted", "tandoor-recipes"]
not_affected_if: ["auth-required", "patched-version"]
published_at: "2026-10-16T17:17:35+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:57:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59962", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Tandoor Recipes: ordering parameters leak related user fields to logged-in users

Tandoor Recipes passes unvalidated sort order strings into Django order_by() calls, so an authenticated user can traverse foreign keys with double-underscore paths. Observable result ordering lets that user infer related User values such as password hashes, email addresses and administrator status.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Tandoor Recipes version; versions before `2.6.10` are affected.
- Confirm whether untrusted or self-registered users can log in to the instance.

## Fix

- Upgrade Tandoor Recipes to `2.6.10` or later.
- Until upgraded, restrict who holds accounts on the instance.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59962

## From the sources

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_