CVE-2026-61726 in Tandoor Recipes
Summary
by MITRE • 10/16/2026
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
Tandoor Recipes serves as a comprehensive platform for managing culinary data, including recipes, meal planning, and shopping list generation. Within this ecosystem, the application relies on a multi-layered permission model to control access to sensitive information. The architecture distinguishes between Space-level membership and recipe-specific ownership or sharing permissions. A critical security flaw was identified in versions prior to 2.6.12 within the API endpoints responsible for handling recipe steps and ingredients. Specifically, the StepViewSet and IngredientViewSet classes failed to enforce granular authorization checks when processing requests related to private recipes. This vulnerability stems from an incorrect implementation of access control logic where Space-level permissions were prioritized over or incorrectly substituted for recipe-level ownership predicates.
The technical root cause lies in the authentication middleware and permission classes used by these viewsets, namely CustomIsUser and CustomRecipePermission. When an authenticated user possessing read and write API scopes within a specific Space submits a request targeting a private recipe step or ingredient identifier, the system erroneously validates access based solely on the user's membership in that Space. The logic fails to verify whether the requesting user is the owner of the target recipe or has been explicitly granted sharing permissions for it. Consequently, the sub-resource querysets return data and allow updates without verifying the private-recipe ownership status. This represents a classic Broken Access Control vulnerability where horizontal privilege escalation occurs within the same organizational boundary due to insufficient object-level authorization checks.
The operational impact of this flaw is significant for users relying on Tandoor Recipes for personal or confidential meal planning. An attacker who shares a Space with a victim can exploit this misconfiguration to read private recipe instructions that are intended to be visible only to the owner. Furthermore, because the API endpoints allow write operations under these flawed conditions, an authenticated user can silently modify another member's private recipe steps and ingredients without authorization. This compromises both the confidentiality and integrity of sensitive culinary data. It is important to note that this vulnerability is confined within Space boundaries; cross-Space access remains out of scope as other security controls effectively prevent unauthorized entry into different organizational units.
This incident aligns with CWE-284, Improper Access Control, specifically highlighting failures in object-level permission verification. In the context of the MITRE ATT&CK framework, this vulnerability facilitates lateral movement within a trusted environment and could be categorized under techniques related to Collection or Data Manipulation if exploited for malicious data exfiltration or sabotage. The flaw underscores the importance of implementing defense-in-depth strategies where session-based access is continuously validated against resource-specific ownership rules rather than relying on broad group memberships.
To mitigate this risk, organizations using Tandoor Recipes must upgrade immediately to version 2.6.12 or later, which contains the necessary patches to enforce correct recipe-level authorization checks. Administrators should also review their Space configurations and ensure that API scopes are granted only to trusted users who require such privileges. Regular security audits of custom permission classes like CustomIsUser can help identify similar logic errors in other parts of the application. Maintaining up-to-date software versions is critical, as vendors frequently release patches for access control flaws discovered during development or through community reporting.