{"metadata": {"vulnerability": "CVE-2026-59963", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-07-07T18:49:15.608Z", "date_only": false, "value": "2026-07-07T18:49:15.608Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-59963", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T19:17:25.148Z", "date_only": false, "value": "2026-10-16T19:17:25.148Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59963", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T19:17:25.148Z", "date_only": false, "value": "2026-10-16T19:17:25.148Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-59963", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:20:37.939Z", "date_only": false, "value": "2026-10-16T19:20:37.939532Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452206071704685", "record": "CVE-2026-59963", "field": "creation_timestamp", "uuid": "9995f656-9bba-4935-8426-3d56f5a831ec", "content": "CVE-2026-59963 Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59963https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-cqj3-64qw-4w52https://github.com/TandoorRecipes/recipes/commit/82fd4e00f1387a1c466489989f2e94487149f7f4https://github.com/TandoorRecipes/recipes/commit/8b4a4c06902d024609d7376b6c45f5ea4f9bed07https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10#TandoorRecipes #recipes#CVE_2026_59963#bot", "url": "https://infosec.exchange/users/cve/statuses/117452206071704685"}, {"timestamp": "2026-10-16T19:34:21.929Z", "date_only": false, "value": "2026-10-16T19:34:21.929785Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-59963", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T19:34:21.929Z", "date_only": false, "value": "2026-10-16T19:34:21.929785Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59963", "record": "FKIE_CVE-2026-59963", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T20:17:23.567Z", "date_only": false, "value": "2026-10-16T20:17:23.567", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59963", "record": "FKIE_CVE-2026-59963", "field": "published"}, {"timestamp": "2026-10-16T21:16:08.364Z", "date_only": false, "value": "2026-10-16T21:16:08.364Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-59963", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:16:08.364Z", "date_only": false, "value": "2026-10-16T21:16:08.364Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-59963", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T22:17:24.137Z", "date_only": false, "value": "2026-10-16T22:17:24.137", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59963", "record": "FKIE_CVE-2026-59963", "field": "lastModified"}]}