Vendor
CVE-2026-59963 allows an authenticated user to bypass object-level authorization and access, share, or exfiltrate private recipes via utility API endpoints.