CVE-2026-93736— Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
Quick assessment
Affected
mealie-recipes mealie
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 3.21.0 之前的 Mealie 版本中，评分和收藏接口未能正确验证用户所有权，导致经过身份验证的攻击者可以通过在 URL 路径中指定任意用户 ID，读取其他用户的食谱评分和收藏信息。攻击者可借此获取不同组或家庭下其他用户的私有食谱标识符、评分值以及收藏标记。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| mealie-recipes | mealie | < 3.21.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93736
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mealie-recipes | mealie | 0 ~ 3.21.0 | - |
|
II. Public POCs for CVE-2026-93736
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93736
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-93736 (2)
Other References for CVE-2026-93736 (6)
-
-
-
-
-
🔗 Release v3.21.0 · mealie-recipes/mealie · GitHub release-notes
-
IV. Related Vulnerabilities
Same product: mealie
-
CVE-2026-94028
mealie-recipes Mealie Recipe Action Trigger controller_group -
CVE-2026-71210
mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal -
CVE-2024-31994
Mealie vulnerable to a DoS in recipe image importer (GHSL-20 -
CVE-2024-31993
Mealie vulnerable to a GET-based SSRF in recipe image import -
CVE-2024-31992
Mealie contains a DoS vulnerability in recipe importer
Same vendor: mealie-recipes
-
CVE-2026-94028
mealie-recipes Mealie Recipe Action Trigger controller_group -
CVE-2026-71210
mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal -
CVE-2024-31994
Mealie vulnerable to a DoS in recipe image importer (GHSL-20 -
CVE-2024-31993
Mealie vulnerable to a GET-based SSRF in recipe image import -
CVE-2024-31992
Mealie contains a DoS vulnerability in recipe importer
Same weakness: CWE-639
-
CVE-2026-93991
Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosur -
CVE-2026-93955
grimmory-tools grimmory Download Endpoint KoboController.jav -
CVE-2026-89333
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Aut -
CVE-2026-76901
CordysCRM: Broken object-level authorization in lead pool an -
CVE-2026-81182
SysReptor: Unauthorized file disclosure by broken access con
V. Comments for CVE-2026-93736
No comments yet