From 6889101a760a457019276c10514e630660b3ed28 Mon Sep 17 00:00:00 2001
From: Hayden <64056131+hay-kot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 12:33:56 -0500
Subject: [PATCH] fix: restrict user ratings and favorites reads to the
 requesting user (#7903)

---
 mealie/routes/users/ratings.py                |  2 ++
 .../user_recipe_tests/test_recipe_ratings.py  | 30 +++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/mealie/routes/users/ratings.py b/mealie/routes/users/ratings.py
index 16adc99e5..11921fa61 100644
--- a/mealie/routes/users/ratings.py
+++ b/mealie/routes/users/ratings.py
@@ -44,11 +44,13 @@ class UserRatingsController(BaseUserController):
     @router.get("/{id}/ratings", response_model=UserRatings[UserRatingOut])
     async def get_ratings(self, id: UUID4):
         """Get user's rated recipes"""
+        assert_user_change_allowed(id, self.user, self.user)
         return UserRatings(ratings=self.repos.user_ratings.get_by_user(id))
 
     @router.get("/{id}/favorites", response_model=UserRatings[UserRatingOut])
     async def get_favorites(self, id: UUID4):
         """Get user's favorited recipes"""
+        assert_user_change_allowed(id, self.user, self.user)
         return UserRatings(ratings=self.repos.user_ratings.get_by_user(id, favorites_only=True))
 
     @router.post("/{id}/ratings/{slug}")
diff --git a/tests/integration_tests/user_recipe_tests/test_recipe_ratings.py b/tests/integration_tests/user_recipe_tests/test_recipe_ratings.py
index 8d61035c3..ad00cd9a3 100644
--- a/tests/integration_tests/user_recipe_tests/test_recipe_ratings.py
+++ b/tests/integration_tests/user_recipe_tests/test_recipe_ratings.py
@@ -412,3 +412,33 @@ def test_average_recipe_rating_includes_all_households(
     assert response.status_code == 200
     data = response.json()
     assert data["rating"] == 3.5
+
+
+def test_cannot_read_other_users_ratings_or_favorites_cross_group(
+    api_client: TestClient, unique_user: TestUser, g2_user: TestUser
+):
+    # g2_user is in a different group entirely
+    response = api_client.get(api_routes.users_id_ratings(unique_user.user_id), headers=g2_user.token)
+    assert response.status_code == 403
+
+    response = api_client.get(api_routes.users_id_favorites(unique_user.user_id), headers=g2_user.token)
+    assert response.status_code == 403
+
+
+def test_cannot_read_other_users_ratings_or_favorites_same_group(
+    api_client: TestClient, unique_user: TestUser, h2_user: TestUser
+):
+    # h2_user is in the same group but a different household
+    response = api_client.get(api_routes.users_id_ratings(unique_user.user_id), headers=h2_user.token)
+    assert response.status_code == 403
+
+    response = api_client.get(api_routes.users_id_favorites(unique_user.user_id), headers=h2_user.token)
+    assert response.status_code == 403
+
+
+def test_can_read_own_ratings_and_favorites_via_id_route(api_client: TestClient, unique_user: TestUser):
+    response = api_client.get(api_routes.users_id_ratings(unique_user.user_id), headers=unique_user.token)
+    assert response.status_code == 200
+
+    response = api_client.get(api_routes.users_id_favorites(unique_user.user_id), headers=unique_user.token)
+    assert response.status_code == 200