CVE-2026-28503 in recipes
Résumé (Anglaise)
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncViewSet.query_synced_folder()` action in `cookbook/views/api.py` (line 903) fetches a Sync object using `get_object_or_404(Sync, pk=pk)` without including `space=request.space` in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Responsable
GitHub_M
Réserver
27/02/2026
Divulgation
26/03/2026
Statut
Confirmé
Entrées
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnérabilité | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 353747 | TandoorRecipes recipes api.py query_synced_folder élévation de privilèges | 639 | Non défini | Correctif officiel | CVE-2026-28503 |