CVE-2026-93736 in Mealie
Summary
by MITRE • 09/18/2026
Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Mealie versions prior to 3.21.0 represents a critical failure in server-side object reference validation within the application's API layer. Specifically, the endpoints responsible for retrieving user ratings and favorited recipes do not enforce proper access control checks against the authenticated session of the requesting user. Instead of verifying that the resource being accessed belongs to the identity currently holding the authentication token, the system blindly trusts the user identifier provided in the Uniform Resource Locator path parameters. This architectural flaw allows an attacker who has successfully authenticated with a valid account to manipulate these URL paths by substituting their own numeric or alphanumeric user ID with those of other target users. By doing so, the application retrieves and returns sensitive data associated with the specified arbitrary user IDs without performing any secondary authorization checks to confirm ownership or permission rights.
From a technical perspective, this issue is classified under CWE-639, which describes Authorization Bypass Through User-Controlled Key. The root cause lies in the backend logic that processes requests for recipe ratings and favorites lists. When an API call is made with a user ID parameter, such as /api/users/{id}/ratings or /api/users/{id}/favorites, the server fetches data linked to that specific identifier without cross-referencing it against the claims contained within the JWT or session token of the authenticated requester. This lack of indirect object reference validation effectively turns these endpoints into public information disclosure vectors for any user whose ID can be guessed or enumerated. Since Mealie supports multi-user environments with distinct groups and households, this flaw enables lateral movement across organizational boundaries, allowing users in one household to窥视 data belonging to another if they possess valid credentials themselves.
The operational impact of this vulnerability is significant regarding the confidentiality integrity of user preferences and behavioral patterns. An attacker can harvest private recipe identifiers, specific rating values ranging from one to five stars, and favorite flags for a wide array of recipes associated with other users. This information reveals personal dietary habits, cooking interests, and potentially sensitive lifestyle choices that users expect to remain confined within their own digital space or household group. In the context of Mealie's social features, where users may share lists publicly but keep individual preferences private, this breach undermines trust in the platform's privacy model. Furthermore, because user IDs are often sequential integers starting from one, an attacker can perform automated enumeration attacks to scrape data for hundreds or thousands of accounts with minimal effort and low detection risk, leading to a large-scale exposure of personal preference data across the entire instance.
This vulnerability maps directly to several techniques in the MITRE ATT&CK framework, particularly T1078 Valid Accounts, as exploitation requires initial authentication, and T1539 Steal Web Session Cookie or similar mechanisms for credential access if combined with other flaws, though here it is primarily T1213 Data from Information Repositories. The attacker leverages valid credentials to query an information repository (the database of ratings and favorites) using a controlled key (user ID). To mitigate this risk, immediate action must be taken by upgrading the Mealie installation to version 3.21.0 or later, where the developers have implemented strict ownership verification logic in these endpoints. Until the upgrade is performed, administrators should consider restricting API access via reverse proxy rules if possible and monitoring for unusual patterns of user ID enumeration in server logs. Additionally, implementing rate limiting on authentication-related endpoints can help mitigate brute-force attempts that might precede this exploitation phase.