Live › vulnerability › CVE-2026-59967
Go to dashboardTandoor Recipes lets an authenticated member of a shared Space submit another member's pending bookmarklet import ID to the recipe-from-source endpoint. The request returns that member's stored URL and captured page content and then deletes their pending import.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Tandoor Recipes before 2.6.10 where several users share a Space and use the bookmarklet import feature. The attacker needs a normal account in the same Space as the victim, and the victim's pending import ID must be guessable by sequence. Single-user installs have no other member to target.
No product ranges from the sources yet.
unknown for the exact check command, the sources do not say how to read it from a deployment2.6.10 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-59967")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.