CVE-2026-59967: CWE-639: Authorization Bypass Through User-Controlled Key in TandoorRecipes recipes

CVE-2026-59967 is an authorization bypass vulnerability in Tandoor Recipes (product 'recipes') affecting versions before 2.6.10. The vulnerability arises from the /api/recipe-from-source/ endpoint, which processes a BookmarkletImport by sequential primary key within the active Space but fails to restrict access based on the 'created_by' user field. As a result, an authenticated member of a shared Space can submit another member's pending bookmarklet identifier, causing the application to parse and return the victim's stored URL and captured page content and then unconditionally delete the victim's pending import. This leads to unauthorized disclosure of private content and destruction of another member's pending import. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An authenticated user in a shared Space can access private captured page content belonging to another user and delete that user's pending bookmarklet import. This results in confidentiality loss of private data and availability impact by destroying pending imports. There is no indication of integrity impact or remote unauthenticated exploitation.

This vulnerability is fixed in Tandoor Recipes version 2.6.10. Users should upgrade to version 2.6.10 or later to remediate this issue. No other mitigation or workaround is indicated in the available data.