EUVD-2026-19673Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
7DescriptionGitHub Advisory
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods - including DELETE, PUT, and PATCH - without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.
AnalysisAI
Privilege escalation in Tandoor Recipes prior to version 2.6.4 allows authenticated users with read-only shared access to recipe books to perform unauthorized write and delete operations. The CustomIsShared permission class incorrectly permits DELETE, PUT, and PATCH methods without validating safe HTTP methods, enabling shared users to overwrite or delete recipe books despite having semantically read-only permissions. This represents a high-severity authorization bypass with CVSS 8.1 (AV:N/AC:L/PR:L) requiring authenticated access but no user interaction. No public exploit identified at time of analysis, though the vulnerability affects a specific permission boundary and could be easily exploited by any user granted shared access.
Technical ContextAI
Tandoor Recipes (cpe:2.3:a:tandoorrecipes:recipes) is a Django-based web application for recipe management. The vulnerability stems from CWE-749 (Exposed Dangerous Method or Function) in the CustomIsShared permission class implementation. Django REST Framework permission classes use has_object_permission() to control access to API endpoints. Properly implemented permission classes should check if request.method is in Django's SAFE_METHODS constant (GET, HEAD, OPTIONS) before granting access for read-only sharing scenarios. The flawed CustomIsShared.has_object_permission() implementation in RecipeBookViewSet and RecipeBookEntryViewSet omits this check, returning True unconditionally for all HTTP methods. This allows authenticated users in a recipe book's shared list to invoke destructive operations (DELETE to remove books, PUT/PATCH to overwrite content) that should be restricted to owners. The vulnerability represents a classic authorization logic error where permission validation fails to distinguish between read and write operations.
RemediationAI
Upgrade to Tandoor Recipes version 2.6.4 or later, which includes a fix for the permission validation logic in CustomIsShared.has_object_permission(). The patch release is available at https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4. Organizations should prioritize this upgrade for multi-user deployments where recipe book sharing is actively used. As an interim mitigation if immediate patching is not possible, administrators could disable or restrict the recipe book sharing feature through application configuration, though this reduces functionality. Review audit logs for suspicious DELETE, PUT, or PATCH requests to RecipeBook and RecipeBookEntry endpoints from shared users to identify potential exploitation. After upgrading, validate that shared users can only perform read operations on recipe books and verify that write operations are properly restricted to book owners.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Tandoor Recipes prior to 2.5.1 contains a blind server-side request forgery vulnerability in the Cookmate recipe import
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. Rated medium severity (CVS
Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. Rated medium severity (CVSS 6.5), t
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” fu
Path traversal in Tandoor Recipes prior to 2.5.1 allows authenticated users with import permissions to read arbitrary fi
Authenticated users can modify and expose private recipes in Tandoor Recipes through broken object-level authorization i
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Ke
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard funct
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functiona
Unauthenticated API input validation flaws in Tandoor Recipes (<2.6.4) enable cross-tenant data leakage and denial of se
Tandoor Recipes versions prior to 2.6.0 allow authenticated remote attackers to cause denial of service by injecting URL
Same weakness CWE-749 – Exposed Dangerous Method or Function
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today