Recipes CVE-2026-28503

The CVSS 4.0 base score of 5.5 reflects a network-accessible vulnerability requiring high privilege (PR:H - admin role) with no user interaction, but limited scope and no confidentiality or availability impact, only integrity impact (VI:H). The attack vector (AV:N) and low complexity (AC:L) indicate easy accessibility once administrative credentials are obtained. The EPSS metric indicates this is estimated to be exploitable with moderate probability. Critically, this is not a privilege escalation from low to high privilege; rather, it is a horizontal privilege boundary bypass where an admin in one space gains unauthorized access to peer spaces. This significantly increases real-world risk in multi-tenant deployments where tenants expect strong isolation. The presence of both a GitHub advisory (GHSA-6qpw-gwcq-68fv) and a vendor-released patched version (2.6.0) confirms the vulnerability is recognized and addressed. Given the administrative prerequisite and lack of public exploit code, the immediate threat level is moderate, but deployments with untrusted or compromised admin accounts face material data leakage risk.

An admin user with credentials in Space A (e.g., Organization A's tenant) could directly query the Sync API endpoint with a primary key belonging to a Sync configuration in Space B. Because the endpoint does not validate space membership, the API would return the sync configuration and permit the attacker to trigger a sync operation, pulling data from Space B's configured external storage (e.g., a shared Dropbox account) and writing it to Space B's database. The attacker could then view the sync logs to confirm successful data access, effectively exfiltrating information from a peer tenant without that tenant's knowledge or consent.