Tandoor Recipes CVE-2026-61726

Exploitation requires the attacker to be an authenticated user who is a member of the SAME Space as the victim and to hold both read and write API scope in that Space; the targeted recipe must be marked private (the flaw is that private-recipe owner/sharing checks are skipped in favor of CustomIsUser role checks and active-Space filtering). The attacker must also supply a valid private recipe step or ingredient identifier via the Step/Ingredient API (api/step/, api/step/{step_id}/). LIMITING FACTORS: cross-Space access is explicitly out of scope, so multi-tenant isolation between Spaces still holds; a single-user instance or one where private recipes are never shared into a common Space is not realistically exploitable; and the attacker needs legitimate write-scoped credentials in the victim's Space, making this an insider/co-tenant threat rather than remote-unauthenticated. Fixed in 2.6.12.

This is a genuine, moderately high-priority authorization flaw (CWE-284, broken object-level access control / IDOR) rather than a CVSS-inflated non-issue, but its real-world urgency is tempered by a significant precondition. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) correctly signals a low-complexity network attack requiring low privileges and no user interaction, with high confidentiality and integrity impact and no availability impact - matching the description of silent read/modify of another user's private recipe data. The critical limiting signal is PR:L combined with the description's requirement that the attacker be an authenticated member of the VICTIM's Space holding read+write API scope; cross-Space access is explicitly out of scope, so this is an insider/same-tenant threat, not an anonymous internet attack. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or published exploit code - the exploitation probability signals are simply absent rather than conflicting. Net: a real, easily-weaponized bug for anyone who can already join a shared Space, but the blast radius is confined to co-tenants of a multi-user Tandoor instance, which lowers aggregate real-world risk versus the raw 8.1.

An authenticated user who belongs to a shared Tandoor Space (with read and write API scope) obtains or guesses the numeric step or ingredient ID of another member's recipe marked private. Because StepViewSet and IngredientViewSet authorize only on active-Space membership and role-level CustomIsUser rather than the private-recipe owner/sharing predicate, the attacker issues a GET to api/step/{step_id}/ to read the hidden instructions and a PATCH to silently alter them. No public exploit code was identified in the provided data; the attack requires only standard API calls and low complexity (AC:L).