EUVD-2026-16295Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the SyncViewSet.query_synced_folder() action in cookbook/views/api.py (line 903) fetches a Sync object using get_object_or_404(Sync, pk=pk) without including space=request.space in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.
AnalysisAI
Tandoor Recipes versions prior to 2.6.0 allow authenticated admin users to bypass space isolation controls and trigger synchronization operations on Sync configurations belonging to other organizational spaces, exposing the ability to initiate Dropbox, Nextcloud, or local imports outside the attacker's own space and access resulting sync logs. The vulnerability stems from missing space validation in the SyncViewSet.query_synced_folder() API endpoint, enabling horizontal privilege escalation across multi-tenant deployments. No public exploit code has been identified at the time of analysis.
Technical ContextAI
Tandoor Recipes (cpe:2.3:a:tandoorrecipes:recipes) is a multi-tenant recipe management application that uses a space-based access control model to isolate data between organizational units. The vulnerability exists in the cookbook/views/api.py file at line 903, where the SyncViewSet.query_synced_folder() action retrieves Sync objects using Django's get_object_or_404(Sync, pk=pk) without filtering by space=request.space. This represents a CWE-639 (Authorization Bypass Through User-Controlled Key) vulnerability, where the primary key lookup alone is insufficient to enforce tenant isolation. The Sync model manages integrations with external storage providers (Dropbox, Nextcloud) and local filesystem imports; without space validation, an attacker with admin credentials in one space can manipulate sync configurations and view logs from other spaces, bypassing the intended multi-tenant segregation.
RemediationAI
Upgrade Tandoor Recipes to version 2.6.0 or later immediately. The patched version includes proper space filtering in the SyncViewSet.query_synced_folder() action to enforce tenant isolation. Until an upgrade can be performed, restrict admin account access to trusted personnel only and monitor API access logs for unauthorized requests to the /api/sync/ endpoint from different spaces. Apply network-level access controls to limit direct API access to the application and consider implementing additional audit logging around sync operations.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Tandoor Recipes prior to 2.5.1 contains a blind server-side request forgery vulnerability in the Cookmate recipe import
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. Rated medium severity (CVS
Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. Rated medium severity (CVSS 6.5), t
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” fu
Tandoor Recipes versions prior to 2.6.0 allow unlimited brute-force password guessing attacks against any known username
Path traversal in Tandoor Recipes prior to 2.5.1 allows authenticated users with import permissions to read arbitrary fi
Privilege escalation in Tandoor Recipes prior to version 2.6.4 allows authenticated users with read-only shared access t
Authenticated users can modify and expose private recipes in Tandoor Recipes through broken object-level authorization i
Tandoor Recipes versions through 2.5.3 permit Host header injection attacks that enable invite link poisoning, allowing
Tandoor Recipes application versions prior to 2.6.0 expose complete database schema and access control logic through an
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Ke
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today