CVE-2026-61726
8.1HighPublished 16 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-284, CWE-639, CWE-863
Impact
Authenticated users can read and modify private recipe steps belonging to other members within the same Space. Attackers only need valid read and write API scope credentials within the target Space.
Root cause
The StepViewSet and IngredientViewSet querysets enforce active Space membership and role checks instead of verifying private recipe ownership or sharing predicates.
Affected systems
Tandoor Recipes prior to 2.6.12
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Tandoor Recipes to version 2.6.12. If patching immediately is not possible, restrict untrusted accounts from receiving write API access in shared Spaces.
$ docker compose pull && docker compose up -dAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.