Mealie EUVD-2026-83026

Requires an authenticated Mealie account (PR:L) on the target instance; exploitation is remote over the network with no user interaction and works against default configurations of the ratings and favorites endpoints in versions before 3.21.0. The attacker supplies an arbitrary victim user ID (UUID) in the URL path. Limiting factors: the attacker must already have a valid account and needs to know or enumerate target user UUIDs; impact is read-only disclosure of ratings, favorite flags, and private recipe identifiers, with no write access or service impact. Notably, no shared group or household membership is required - cross-group access succeeds - which raises exposure on any multi-user instance.

This is a genuine but low-severity authorization flaw (IDOR/BOLA, CWE-639), not a high-CVSS emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L, no integrity or availability impact) accurately reflects a network-reachable, low-complexity but authenticated read-only information disclosure - an attacker must hold a valid account on the target Mealie instance. No EPSS score, no CISA KEV listing, and no public PoC are present in the input; per the precision rules this means no public exploit is identified at time of analysis, and there is no evidence of active exploitation. The exploitation itself is trivial (swap a user ID in the URL path), so the low-complexity rating is warranted, but impact is confined to leaking other users' recipe ratings, favorite flags, and private recipe identifiers across groups/households - no code execution, no data modification, no service impact. Signals are consistent and non-conflicting: a moderate CVSS from a real access-control bug, corroborated by source-code evidence (the fix adds ownership assertions) and a vendor patch. Bottom line: real, verifiable, patch-worthy on multi-tenant/shared instances, but a routine-priority information-disclosure issue rather than a critical one. One caveat: the input tags this as 'Authentication Bypass' whereas both the description and CWE-639 make clear it is an authorization (ownership-validation) bypass - verify tagging.

An authenticated user on a shared Mealie instance (e.g., a household member, or a user in an entirely different group) sends a GET request to the ratings or favorites endpoint substituting another user's UUID into the URL path. The server returns that victim's private recipe identifiers, rating values, and favorite flags without checking ownership. No public exploit code is identified, but the attack requires only a trivial parameter substitution against a valid account.