CVE-2025-57396: Medium severity Tandoor Recipes vulnerability
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or administrative. Consequently, any user can escalate their privileges to the highest level.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57396?
CVE-2025-57396 is rated as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-57396?
To fix CVE-2025-57396, upgrade to Tandoor Recipes version 2.0.0-alpha-2 or later.
What is the impact of CVE-2025-57396 on Tandoor Recipes?
CVE-2025-57396 allows unauthorized users to escalate their privileges, potentially compromising the security of the application.
Which versions of Tandoor Recipes are affected by CVE-2025-57396?
CVE-2025-57396 affects Tandoor Recipes version 2.0.0-alpha-1, and later versions should be used to mitigate the risk.
Is the privilege escalation in CVE-2025-57396 permanent?
The privilege escalation in CVE-2025-57396 can be exploited until the affected software is updated to a patched version.