CVE-2026-28503: Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the SyncViewSet.querysyncedfolder() action in cookbook/views/api.py (line 903) fetches a Sync object using getobjector404(Sync, pk=pk) without including space=request.space in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28503?
CVE-2026-28503 has been classified as a high-severity vulnerability due to the risk of unauthorized access to sensitive data.
How do I fix CVE-2026-28503?
To fix CVE-2026-28503, update Tandoor Recipes to version 2.6.0 or later, where the vulnerability has been addressed.
What is affected by CVE-2026-28503?
CVE-2026-28503 affects all versions of Tandoor Recipes prior to 2.6.0.
What is the impact of CVE-2026-28503?
The impact of CVE-2026-28503 includes potential exposure to unauthorized data access due to cross-space IDOR.
How can I determine if I am vulnerable to CVE-2026-28503?
You can determine if you are vulnerable to CVE-2026-28503 by checking if your Tandoor Recipes installation is version 2.6.0 or earlier.