CVE-2026-61726: Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{stepid}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tandoor Recipesto a version that resolves this vulnerability.Fixed in 2.6.12
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has read and write API scope in the same Space as the victim can exploit it. The attacker does not need to own the private recipe, but cross-Space access is not affected.
What access does an attacker need to obtain or change private recipe content?
The attacker needs a private recipe or step identifier and access to the Step API endpoints, including /api/step/ and /api/step/{step_id}/. They can read and silently modify instructions in another member's private recipe within the same Space.
Which deployments are affected?
Versions prior to 2.6.12 are affected. The authorization flaw occurs because StepViewSet and IngredientViewSet authorize based on active Space membership rather than private-recipe ownership or sharing permissions.
How can this be remediated?
Upgrade Tandoor Recipes to version 2.6.12, which fixes the issue. The provided data does not identify an alternative mitigation for environments that cannot upgrade immediately.