CVE-2026-93736 is an authorization bypass vulnerability affecting mealie-recipes mealie before version 3.21.0. The application fails to validate user ownership in the ratings and favorites endpoints, enabling authenticated attackers to read any user's recipe ratings and favorites by manipulating user IDs in the URL path. This flaw exposes sensitive user-specific data such as private recipe identifiers, rating values, and favorite flags belonging to other users, potentially across different groups or households.

Authenticated attackers can access sensitive user data related to recipe ratings and favorites that they should not be authorized to view. This compromises user privacy by exposing private recipe identifiers and preference data across different user groups or households. The vulnerability does not indicate privilege escalation beyond reading data or direct system compromise.

Upgrade mealie to version 3.21.0 or later where this authorization validation issue has been fixed. Patch status is confirmed by the version boundary in the affectedVersions field. No additional vendor advisory was provided, so check the official mealie release notes or security advisories for confirmation and further guidance.