TandoorRecipes vulnerabilities
We track 11 vulnerabilities in TandoorRecipes products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest TandoorRecipes vulnerabilities
- 7.7 High severity
recipes: Server-Side Request Forgery
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious im
- 8.1 High severity
recipes: Improper Access Control
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sh
- 7.7 High severity
recipes: Server-Side Request Forgery
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an auth
- 7.1 High severity
recipes: Authorization Bypass Through User-Controlled Key
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authentica
- 7.3 High severity
recipes: Authorization Bypass Through User-Controlled Key
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListE
- 8.1 High severity
recipes: Exposed Dangerous Method or Function
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission()
- 8.1 High severity
recipes: Authorization Bypass Through User-Controlled Key
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space,
- 7.5 High severity
recipes: Improper Restriction of Excessive Authentication Attempts
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAut
- 8.1 High severity
recipes: Improper Neutralization of HTTP Headers for Scripting Syntax
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The
- 7.7 High severity
recipes: Server-Side Request Forgery
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fai
- 9.9 Critical severity
recipes: Improper Control of Generation of Code
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is f