Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
Priority MEDIUM 57CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00387 33rd percentileScored 2026-11-07
Fix Fixed mealie (mealie-recipes): 3.21.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mealie-recipes | mealie | before 3.21.0 | 3.21.0 | Patch available | CNA |
- mealie Vendormealie-recipes Affected before 3.21.0 Fixed in 3.21.0 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:* | — | — | mealie-recipes |
- cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:* Versions — — ·mealie-recipes
Remediation
- Fix · CNA mealie (mealie-recipes) Fixed in 3.21.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-93736
- 2026-10-03 Alias added: GHSA-8wpj-9x79-phww
References
Patch 2
More mealie-recipes vulnerabilities
- TI-2025-35411 Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe… CVSS 3.1CRITICAL 9.0
- TI-2024-36768 A Broken Object Level Authorization vulnerability in the component /api/users/{user-id}… CVSS 3.1HIGH 7.6
- TI-2024-21092 Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227) CVSS 3.1MEDIUM 6.2
- TI-2025-43084 A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media… CVSS 3.1MEDIUM 6.1
- TI-2025-43083 A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie… CVSS 3.1MEDIUM 5.4
- TI-2024-36767 A Broken Object Level Authorization vulnerability in the component /api/users/{user-id}… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-93736 · CVE Program
- CVE-2026-93736 · NVD
- FIRST EPSS
- GHSA-8wpj-9x79-phww · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences