Vulnerabilidades de Mealie-recipes
CVEs publicadas que afetam produtos de Mealie-recipes: 3 registro(s), com severidade, exploração e correções.
CVE-2026-108594
Baixa · 3.5
CWE-918 10/10/2026
Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
CVE-2026-94028
Média · 4.3
CWE-918 20/09/2026
mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.26.0 is able to address this issue. This patch is called fb221afa258c8dd2c4ac95b1996c33ef9db3f477. The affected component should be upgraded.
CVE-2026-93736
Média · 4.3
CWE-639 18/09/2026
Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households.