---
id: "CVE-2026-59967"
kind: "vulnerability"
aliases: ["CVE-2026-59967"]
title: "Tandoor Recipes: shared-space members can read and delete others' pending imports"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["docker", "package", "self-hosted", "tandoor-recipes"]
not_affected_if: ["bookmarklet-import-unused", "single-user-space", "upgraded-to-2.6.10"]
published_at: "2026-10-16T17:17:35+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:18:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59967", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Tandoor Recipes: shared-space members can read and delete others' pending imports

Tandoor Recipes lets an authenticated member of a shared Space submit another member's pending bookmarklet import ID to the recipe-from-source endpoint. The request returns that member's stored URL and captured page content and then deletes their pending import.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Tandoor version; `unknown` for the exact check command, the sources do not say how to read it from a deployment
- Confirm whether users share a Space with members who should not see each other's bookmarklet imports

## Fix

- Upgrade Tandoor Recipes to `2.6.10` or later

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59967

## From the sources

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_