Tandoor Recipes CVE-2026-112342

Exploitation requires a multi-space (multi-tenant) Tandoor deployment and an attacker who is already an authenticated member of at least one space (PR:L). The attacker leverages the ability to create a new space (POST /api/space/), which auto-grants the creator that space's admin group, then uses switch_user_active_space() to move into a victim space; because has_group_permission() keys GROUP_CACHE_<pk> on user id only (omitting the active space) and refreshes the 30-second TTL on every request, the previously cached admin groups keep authorizing checks indefinitely under continuous activity. Limiting factors: the vulnerability is irrelevant on single-space instances; authentication is required; and the default per-process LocMemCache means the stale entry lives only in the worker that primed it, so on multi-worker deployments the subsequent escalated request must reach that same worker to succeed.

This is a genuine but conditional privilege-escalation flaw (CWE-863, Incorrect Authorization) rated CVSS 4.0 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N. The signals are internally consistent: network vector, low complexity, no user interaction, and low privilege (PR:L) matching the requirement that the attacker already be an authenticated member of the Tandoor instance; integrity impact is High (VI:H) because the attacker gains unauthorized admin-level write/control in a victim space, while confidentiality is Low and availability None. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency), indicating prompt-but-not-crisis remediation. The researcher (VulnCheck) provides a verified proof-of-concept harness in the GHSA advisory, and the advisory notes the attack is self-serviceable, which raises practical concern above a theoretical finding. The key limiter is that real-world risk is confined to multi-space (multi-tenant) deployments - single-space self-hosted instances are effectively unaffected - and the default per-process LocMemCache means that on multi-worker deployments the follow-up malicious request must land on the same worker that primed the stale cache, reducing reliability. Net: a real priority for shared/multi-tenant Tandoor instances, lower concern for typical single-user self-hosting.

On a shared multi-space Tandoor instance, an authenticated low-privilege user creates their own space via POST /api/space/ and is automatically granted that space's admin group; one request as admin primes the GROUP_CACHE_<pk> cache entry with admin group names. The user then switches their active space to a victim space where they are only a guest/user, and the stale cached admin decision authorizes elevated actions and defeats group revocations. A verified PoC harness demonstrating the control/bypass/revocation sequence is described in the GHSA advisory (VulnCheck).