ORM order_by injection in Tandoor Recipes exposes related user data
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Tandoor Recipes before 2.6.10 passes unvalidated sort order strings into Django ORM order_by() calls in recipe search, RecipeBook, and stored custom filter ordering. An authenticated user can supply foreign-key traversal paths in these values (CWE-943), and the resulting order leaks values from related User fields such as password hashes, email addresses, and administrator status.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TandoorRecipes | recipes | before 2.6.10 | 2.6.10 | Patch available | CNA |
- recipes VendorTandoorRecipes Affected before 2.6.10 Fixed in 2.6.10 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:* | — | — | TandoorRecipes |
- cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:* Versions — — ·TandoorRecipes
Remediation
Upgrade Tandoor Recipes to version 2.6.10, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA recipes (TandoorRecipes) Fixed in 2.6.10
Timeline
- 2026-10-16 Threatist record created from CVE-2026-59962
- 2026-10-18 Priority changed: MEDIUM → LOW
- 2026-10-28 CISA SSVC decision points changed
- 2026-10-28 Priority changed: LOW → MEDIUM
References
Other 5
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-4x57-2q4q-xwpp
- https://github.com/TandoorRecipes/recipes/commit/322696f618997e98f2d4c15ec64b9480735589f0
- https://github.com/TandoorRecipes/recipes/commit/382a976cc79635edc30aef84cb2b2b72eb8afd3c
- https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4
- https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10
More TandoorRecipes vulnerabilities
- TI-2026-25582 Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication CVSS 3.1CRITICAL 9.1
- TI-2025-16996 Tandoor Recipes - SSTI - Remote Code Execution CVSS 3.1CRITICAL 10.0
- TI-2026-25583 SQL injection in TandoorRecipes recipes CVSS 4.0HIGH 7.7
- TI-2026-27618 Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` CVSS 3.1HIGH 7.3
- TI-2025-16998 Tandoor Recipes - Stored XSS through Unrestricted File Upload CVSS 3.1HIGH 8.7
- TI-2026-75529 Authorization bypass in Tandoor Recipes exposes private recipe steps CVSS 3.1HIGH 8.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences