EUVD-2026-19388Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering. This vulnerability is fixed in 2.6.4.
AnalysisAI
Authenticated users can modify and expose private recipes in Tandoor Recipes through broken object-level authorization in the batch update API endpoint. Any authenticated user within a shared Space can modify recipes marked private by other users, force-share private recipes, and tamper with metadata by exploiting the PUT /api/recipe/batch_update/ endpoint which bypasses authorization checks enforced on single-recipe endpoints. Affects all versions prior to 2.6.4. CVSS 8.1 (High) reflects network-accessible attack requiring only low-privilege authentication with no user interaction. No public exploit identified at time of analysis, though exploitation is straightforward for authenticated attackers.
Technical ContextAI
This vulnerability stems from broken object-level authorization (CWE-639), a common API security flaw where batch or bulk operations fail to enforce the same permission checks as their single-resource counterparts. Tandoor Recipes implements a multi-tenant architecture using Spaces where users can share recipes while maintaining privacy controls. The standard PUT /api/recipe/{id}/ endpoint properly validates whether the authenticated user has permission to modify a specific recipe, respecting privacy flags and ownership. However, the batch update endpoint PUT /api/recipe/batch_update/ processes multiple recipe modifications in a single request without performing equivalent object-level authorization checks. This allows any authenticated Space member to include recipe IDs they should not be able to modify in their batch request payload, effectively escalating their privileges horizontally within the Space boundary. The vulnerability particularly impacts the shared list feature and privacy metadata, enabling unauthorized disclosure of sensitive recipe information.
RemediationAI
Upgrade immediately to Tandoor Recipes version 2.6.4 which implements proper object-level authorization checks on the batch update endpoint, released February 2025 and available at https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4. The patch enforces the same permission validation logic used by single-recipe endpoints, ensuring batch operations respect recipe ownership and privacy flags. Organizations unable to immediately upgrade should implement compensating controls including restricting Space membership to fully trusted users only, monitoring API access logs for suspicious batch update requests targeting multiple recipe IDs, and reviewing recipe access permissions to ensure no unauthorized modifications occurred. No effective workaround exists to disable batch updates without code modification since the vulnerable endpoint is integral to bulk recipe management functionality. Post-upgrade, administrators should audit recipe sharing lists and privacy settings to identify any unauthorized modifications that may have occurred while vulnerable.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Tandoor Recipes prior to 2.5.1 contains a blind server-side request forgery vulnerability in the Cookmate recipe import
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. Rated medium severity (CVS
Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. Rated medium severity (CVSS 6.5), t
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” fu
Path traversal in Tandoor Recipes prior to 2.5.1 allows authenticated users with import permissions to read arbitrary fi
Privilege escalation in Tandoor Recipes prior to version 2.6.4 allows authenticated users with read-only shared access t
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Ke
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard funct
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functiona
Unauthenticated API input validation flaws in Tandoor Recipes (<2.6.4) enable cross-tenant data leakage and denial of se
Tandoor Recipes versions prior to 2.6.0 allow authenticated remote attackers to cause denial of service by injecting URL
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today