Tandoor Recipes CVE-2026-59962

Requires an authenticated Tandoor Recipes account (PR:L) on a version prior to 2.6.10; no special non-default configuration is needed. The attacker must supply foreign-key traversal paths via the sort_order or order_field parameters in recipe search, RecipeBook, or stored CustomFilter ordering, reaching _finalize_ordering/order_by through the /api/recipe/ and /api/recipe-book/ endpoints. Exploitation is LIMITED by the need for valid credentials and by its oracle/inference nature - data is leaked indirectly through observable result ordering rather than returned directly, making extraction slow and iterative, and the pre-2.6.10 version constraint bounds the exposed population.

This is a genuine but moderate-priority information-disclosure flaw, best characterized as a high-CVSS-impact-but-constrained-reach issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) is internally consistent with the description: exploitation is network-reachable and low-complexity, but requires an authenticated account (PR:L), and impact is confidentiality-only (C:H, I:N, A:N) via an ordering-oracle that leaks password hashes, email addresses, and administrator status from related User rows. No EPSS score, KEV listing, or public POC was supplied, so there is no evidence of active or at-scale exploitation; the only exploitation signal is the vendor-published GitHub Security Advisory (GHSA-4x57-2q4q-xwpp) and three fix commits confirming the bug is real and well-understood. The main factor raising priority is that the leaked data includes password hashes and admin flags, which can enable privilege escalation or offline cracking; the main factor lowering it is the authentication requirement and the oracle-based, inference-driven nature of the attack (noisy, slow, one value at a time). Note the CWE-943 and the 'Nosql Injection' tag are imprecise - this is a Django ORM relational-traversal leak, not NoSQL injection - so classify it as ORM/query-logic injection, not NoSQL.

A logged-in Tandoor user (any low-privileged account) sends recipe-search, RecipeBook, or CustomFilter requests to /api/recipe/ or /api/recipe-book/ with crafted sort_order/order_field values containing double-underscore foreign-key paths (e.g. traversing to related User fields). By observing how results reorder under different ordering expressions, the attacker builds a boolean/ordering oracle to infer sensitive related-table values such as an administrator's password hash, email, and is_superuser status. No public exploit code was identified at time of analysis, though the fix commits clearly document the vulnerable code path.