CVE-2026-93736
Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 18, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 18, 2026
Description
Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
mealiemealie-recipes |
|
References
- GitHub Issue #7909issue-tracking
- https://github.com/mealie-recipes/mealieproduct
- https://github.com/mealie-recipes/mealie/blob/v3.20.1/mealie/routes/users/ratings.py#L44-L52technical-description
- https://github.com/mealie-recipes/mealie/blob/v3.20.1/mealie/repos/repository_users.py#L82-L88technical-description
- https://github.com/mealie-recipes/mealie/pull/7903patchissue-tracking
- https://github.com/mealie-recipes/mealie/commit/6889101a760a457019276c10514e630660b3ed28patch
- mealie v3.21.0 Release Notesrelease-notes
- VulnCheck Advisory: Mealie before 3.21.0 Information Disclosure via Ratings Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.