CVE-2026-112342 in Tandoor Recipes
Summary
by MITRE • 10/23/2026
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Tandoor Recipes prior to version 2.7.0 represents a critical flaw in the application's authorization logic, specifically within the cookbook helper module responsible for managing user permissions. The core technical issue stems from an improper cache-key design that fails to account for the context of the active workspace or space when determining access rights. In typical multi-tenant applications like Tandoor Recipes, users may belong to multiple distinct spaces, each with its own set of groups and permission levels. However, the caching mechanism utilized by the application keys entries solely based on the user identifier rather than a composite key that includes both the user ID and the specific space context. This oversight means that once a permission decision is cached for a given user, it remains valid regardless of which space the user is currently accessing or interacting with within the platform.
This architectural flaw allows authenticated users to exploit the caching behavior to bypass intended access controls through a technique often referred to as cache poisoning via stale entries. The operational impact is severe because the Time To Live (TTL) for these cached permission decisions is refreshed on every request, effectively preventing the entry from expiring naturally while the user remains active in the application. An attacker can initiate this exploit by first creating their own space where they are able to assign themselves an administrative role or group designation with elevated privileges. Once this high-privilege state is established and cached against their user ID, the attacker switches their active context to a different victim space where they hold only limited permissions or no access at all. Because the application checks its cache first using only the user ID as the key, it retrieves the previously stored administrative permission decision rather than evaluating the actual group membership within the current victim space.
The consequence of this bypass is that the attacker retains elevated access across multiple permission classes and views in spaces where they should not have any such rights. This includes actions typically restricted to administrators or specific role holders, potentially allowing unauthorized modification, deletion, or viewing of sensitive data belonging to other users or organizations within those victim spaces. The vulnerability effectively nullifies group revocations or demotions that might occur after the initial cache entry was created, as the system continues to serve the stale administrative decision until the application is restarted or the cache is manually cleared. This behavior undermines the fundamental principle of least privilege and compromises the integrity of multi-tenant isolation within the Tandoor Recipes environment.
From a standards perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to properly restrict access for users who have been granted elevated privileges in one context but should be restricted in another. It also relates closely to CWE-613 Insufficient Session Expiration, although the mechanism is driven by application-level caching logic rather than session cookies alone. In terms of adversary tactics, this exploitation method corresponds to ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials but manipulates their context to gain unauthorized access. The specific behavior of retaining state across different contexts can also be viewed through the lens of CWE-694 Use of Multiple Resources with Identical Names, as the system incorrectly treats a user identity in one space as equivalent to that same identity in another distinct resource scope without proper differentiation.
Mitigation for this vulnerability requires an immediate upgrade to Tandoor Recipes version 2.7.0 or later, where the cache key design has been corrected to include both the user ID and the active space identifier. This ensures that permission decisions are evaluated independently for each workspace context, preventing cross-space privilege escalation via cached data. In environments where upgrading is not immediately feasible, administrators should consider implementing a manual cache invalidation strategy after any changes to group memberships or role assignments. Additionally, reviewing application logs for unusual patterns of access across multiple spaces by the same user ID can help detect potential exploitation attempts in real-time. Security teams should also audit other areas of the codebase that rely on caching mechanisms to ensure similar context-agnostic key designs are not present elsewhere in the application logic.