CVE-2026-59963Published
Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-59963 · Microsoft / collected KEV context
cve-program · CVE-2026-59963
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-cqj3-64qw-4w52
- https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4
- https://github.com/TandoorRecipes/recipes/commit/8b4a4c06902d024609d7376b6c45f5ea4f9bed07
- https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.