CVE-2026-93736

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93736
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93736.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93736
Published
2026-09-18T16:04:48Z
Modified
2026-09-20T11:47:30Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
Details

Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93736.json"
}
References

Affected packages

Git / github.com/mealie-recipes/mealie

Affected ranges

Type
GIT
Repo
https://github.com/mealie-recipes/mealie
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e22b8e7b734fb56d6f54a44526005104d3ac8f30
Fixed
6889101a760a457019276c10514e630660b3ed28
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.21.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.1.0
v0.*
v0.0.1
v0.0.2
v0.1.0
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.4.0
v1.*
v1.0.0
v1.0.0-RC1
v1.0.0-RC1.1
v1.0.0-RC2
v1.0.0-beta-1
v1.0.0beta-2
v1.0.0beta-3
v1.0.0beta-4
v1.0.0beta-5
v1.1.0
v1.1.1
v1.10.0
v1.10.1
v1.10.2
v1.11.0
v1.12.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.8.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.1.1
v3.1.2
v3.10.0
v3.10.1
v3.10.2
v3.11.0
v3.12.0
v3.13.0
v3.13.1
v3.14.0
v3.15.0
v3.15.1
v3.15.2
v3.16.0
v3.17.0
v3.18.0
v3.19.0
v3.19.1
v3.19.2
v3.2.0
v3.2.1
v3.20.0
v3.20.1
v3.3.0
v3.3.1
v3.3.2
v3.4.0
v3.5.0
v3.6.0
v3.6.1
v3.7.0
v3.8.0
v3.9.0
v3.9.1
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93736.json"