CVE-2026-59970 is a Server-Side Request Forgery (SSRF) vulnerability in Tandoor Recipes prior to version 2.6.10. The application improperly passes an administrator-controlled AI provider URL directly to LiteLLM without applying SSRF protections. This allows an authenticated user to configure an AI provider URL targeting internal network addresses and invoke AI actions that connect to these URLs, bypassing safe request checks. The vulnerability enables blind network reachability detection of internal hosts and ports, including cloud metadata endpoints. The issue is fixed in version 2.6.10.
CVE-2026-61726 is a high-severity improper access control vulnerability in Tandoor Recipes prior to version 2.6.12. It allows authenticated users with read and write API scope within a shared Space to read and modify private recipe steps belonging to other members of the same Space. The flaw arises because the application checks only Space membership rather than recipe-level ownership or sharing permissions when accessing certain API endpoints. This issue does not allow cross-Space access and is fixed in version 2.6.12.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
CVE-2026-59967 is an authorization bypass vulnerability in Tandoor Recipes prior to version 2.6.10. The flaw allows an authenticated member of a shared Space to access and delete another member's pending bookmarklet import by submitting the victim's bookmarklet identifier to the POST /api/recipe-from-source/ endpoint. This results in disclosure of private captured page content and destruction of the victim's pending import. The issue is fixed in version 2.6.10.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service (DoS) vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly degrade its performance by uploading a large size ZIP file (ZIP Bomb). This vulnerability is fixed in 2.6.5.
CVE-2026-35489 is a high-severity vulnerability in Tandoor Recipes versions prior to 2.6.4. It involves the POST /api/food/{id}/shopping/ endpoint improperly handling user-supplied amount and unit data without validation. This can cause unhandled exceptions resulting in HTTP 500 errors and allows cross-space association of unit IDs, leading to potential leakage of foreign-key references across tenant boundaries. The issue is fixed in version 2.6.4.
CVE-2026-35046 is a cross-site scripting (XSS) vulnerability in Tandoor Recipes versions prior to 2.6.4. Authenticated users can inject arbitrary <style> tags into recipe step instructions because the sanitizer used (bleach.clean()) explicitly allows the <style> tag. This results in unsanitized CSS being stored and served via the API. Clients that render these instructions as HTML without further sanitization may execute attacker-controlled CSS, potentially enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. The vulnerability is fixed in version 2.6.4.
CVE-2026-35045 is an authorization bypass vulnerability in Tandoor Recipes versions prior to 2.6.4. It affects the batch update API endpoint, allowing any authenticated user within a Space to modify any recipe in that Space, including private recipes owned by other users. This bypasses object-level authorization checks present in single-recipe endpoints, enabling unauthorized access and modification of private recipe data. The vulnerability is fixed in version 2.6.4.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the FDC (USDA FoodData Central) search endpoint constructs an upstream API URL by directly interpolating the user-supplied `query` parameter into the URL string without URL-encoding. An attacker can inject additional URL parameters by including `&` characters in the query value. This allows overriding the API key, manipulating upstream query behavior, and causing server crashes (HTTP 500) via malformed requests — a Denial of Service condition. Version 2.6.0 patches the issue.
Tandoor Recipes versions prior to 2.6.0 do not strip EXIF metadata from uploaded WebP and GIF images. This leads to exposure of sensitive information such as GPS coordinates, camera model, timestamps, and software details to any user who can view the recipe images. The issue is fixed in version 2.6.0.
CVE-2026-28503 is an authorization bypass vulnerability in Tandoor Recipes versions prior to 2.6.0. The flaw exists in the SyncViewSet.query_synced_folder() function, which fetches Sync objects without properly restricting access by space. This allows an admin user in one space to trigger sync operations and view sync logs belonging to another space. The issue is fixed in version 2.6.0.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.build_absolute_uri() to generate absolute URLs in multiple contexts, including invite link emails, API pagination, and OpenAPI schema generation. An attacker who can send requests to the application with a crafted Host header can manipulate all server-generated absolute URLs. The most critical impact is invite link poisoning: when an admin creates an invite and the application sends the invite email, the link points to the attacker's server instead of the real application. When the victim clicks the link, the invite token is sent to the attacker, who can then use it at the real application. As of time of publication, it is unknown if a patched version is available.