Tandoorrecipes
Monthly
Authenticated blind server-side request forgery in Tandoor Recipes before 2.6.10 allows a user with privileges to create a Space and configure an AI provider URL to force the server to connect to arbitrary internal addresses. The AI actions behind TARGET/api/ai-import/ and api/ai-step-sort/ pass the attacker-supplied provider URL straight to LiteLLM, bypassing the application's safe_request outbound filtering, and the resulting connection success, refusal, or timeout is surfaced as a reachability oracle that can be used to map internal hosts, ports, and cloud metadata endpoints. Exploitation requires an authenticated account (PR:L) and the AI provider feature to be in use, and exposure is limited to a blind oracle rather than confirmed response-body exfiltration; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Broken object-level authorization in Tandoor Recipes before 2.6.12 lets an authenticated member of the same Space, holding read and write API scope, read and silently alter another member's private recipe instructions and ingredients by supplying those private step or ingredient identifiers to the Step/Ingredient API. The affected sub-resource ViewSets (StepViewSet, IngredientViewSet) filter only on active Space and apply role-level CustomIsUser checks instead of the private-recipe owner/sharing predicate, so a co-tenant is accepted without recipe-level authorization. No public exploit code has been identified at time of analysis, and the flaw requires legitimate write-scoped credentials in the victim's Space; it is fixed in version 2.6.12.
An authenticated member of a shared Space in Tandoor Recipes prior to 2.6.10 can reach another member's private recipes - including reading private recipe files, sending those file bytes to the configured AI provider, and generating external or public share links - by supplying the victim's recipe identifier to the api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, or api/share-link/ endpoints, because those flows retrieve Recipe objects without invoking the private-recipe owner/sharing check (CustomRecipePermission). The prerequisite is an account already inside the same shared Space (Space sharing must be enabled) plus knowledge or enumeration of the target recipe ID, so single-user or non-shared deployments are not exposed; scoring is CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) with confidentiality as the dominant impact and no public exploit identified at time of analysis. The issue is fixed in 2.6.10.
Unauthenticated API input validation flaws in Tandoor Recipes (<2.6.4) enable cross-tenant data leakage and denial of service. The /api/food/{id}/shopping/ endpoint accepts unvalidated amount and unit parameters, allowing attackers to cause application crashes via malformed numeric inputs (HTTP 500 errors) and leak foreign-key references across multi-tenant Space boundaries by associating unit IDs from other tenants. CVSS 7.3 reflects network-accessible, low-complexity attacks requiring no authentication. No public exploit identified at time of analysis, though exploitation is straightforward via direct API calls. EPSS data not available. Vendor-released patch: version 2.6.4.
Privilege escalation in Tandoor Recipes prior to version 2.6.4 allows authenticated users with read-only shared access to recipe books to perform unauthorized write and delete operations. The CustomIsShared permission class incorrectly permits DELETE, PUT, and PATCH methods without validating safe HTTP methods, enabling shared users to overwrite or delete recipe books despite having semantically read-only permissions. This represents a high-severity authorization bypass with CVSS 8.1 (AV:N/AC:L/PR:L) requiring authenticated access but no user interaction. No public exploit identified at time of analysis, though the vulnerability affects a specific permission boundary and could be easily exploited by any user granted shared access.
Authenticated users can modify and expose private recipes in Tandoor Recipes through broken object-level authorization in the batch update API endpoint. Any authenticated user within a shared Space can modify recipes marked private by other users, force-share private recipes, and tamper with metadata by exploiting the PUT /api/recipe/batch_update/ endpoint which bypasses authorization checks enforced on single-recipe endpoints. Affects all versions prior to 2.6.4. CVSS 8.1 (High) reflects network-accessible attack requiring only low-privilege authentication with no user interaction. No public exploit identified at time of analysis, though exploitation is straightforward for authenticated attackers.
Tandoor Recipes versions prior to 2.6.0 allow unlimited brute-force password guessing attacks against any known username through API endpoints accepting BasicAuthentication headers. While Django AllAuth rate limiting protects the HTML login form (5 attempts per minute per IP), API endpoints completely bypass these controls, enabling high-speed credential stuffing with no account lockout. A proof-of-concept exploit exists and the attack is automatable per SSVC analysis, though no active exploitation is confirmed in CISA KEV.
Tandoor Recipes application versions prior to 2.6.0 expose complete database schema and access control logic through an undocumented debug parameter in the Recipe API endpoint, allowing any authenticated user to extract raw SQL queries including table structures, JOIN relationships, WHERE conditions, and multi-tenant space identifiers even in production environments with DEBUG=False. A proof-of-concept exploit is available (SSVC exploitation status: poc). The CVSS 4.0 score of 7.7 reflects network-based exploitation with no attack complexity, and SSVC indicates the vulnerability is automatable with partial technical impact.
Tandoor Recipes versions through 2.5.3 permit Host header injection attacks that enable invite link poisoning, allowing authenticated administrators with high privileges to be social-engineered into sending system-generated invite tokens to attacker-controlled servers. The Django application's default ALLOWED_HOSTS='*' configuration fails to validate HTTP Host headers, which combined with request.build_absolute_uri() usage allows manipulation of all absolute URLs including invite emails, API pagination, and OpenAPI schemas. No public exploit identified at time of analysis; CVSS 8.1 reflects network-based attack requiring high privileges and user interaction with changed scope.
Server-side request forgery in the Pestle importer of Tandoor Recipes through 2.6.15 allows an authenticated user with only the standard space 'user' role to make the server issue GET requests to arbitrary internal or external hosts by supplying a crafted image URL in a Pestle JSON import. It is a genuine but moderate-priority issue rather than a top-tier emergency: the flaw is reachable through POST /api/import/ with type=PESTLE, a default-available feature since v2.6.15, and the advisory documents a PoC with reproduced loopback fetch and storage of the internal response as a recipe image. No CISA KEV listing accompanies this CVE in the supplied data; 2.7.0 is the vendor-released fix.
Tandoor Recipes deployments prior to 2.6.10 can be driven into denial of service by an authenticated user who stores a catastrophic-backtracking regular expression in a shared-Space Automation rule, which the server then evaluates with Python's re.sub() during another user's recipe import through the api/recipe-from-source/ endpoint. Because the pattern is executed without complexity validation or any execution timeout, a single crafted rule can monopolize a Gunicorn worker until the request timeout elapses, exhausting available worker slots and making the application unavailable to legitimate users. Exploitation requires a valid authenticated account that belongs to a shared Space plus a second user importing a matching recipe (CVSS 5.7, CWE-1333, AV:N/AC:L/PR:L/UI:R with availability-only impact), no public exploit code has been identified at time of analysis, and the vendor shipped a fix in 2.6.10.
Tandoor Recipes instances running versions prior to 2.6.10 let any authenticated user infer sensitive database values - including password hashes, email addresses, and administrator status - by supplying crafted sort_order or order_field values that Django's ORM resolves as double-underscore foreign-key traversal paths during recipe search and RecipeBook ordering. The exposure is scored 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-943), with confidentiality impact rated High but reach constrained by the need for valid credentials and the indirect, oracle-style nature of the leak. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
An insecure direct object reference (IDOR/BOLA) in Tandoor Recipes prior to 2.6.10 lets an authenticated member of a shared Space read and destroy another member's pending bookmarklet import. By submitting a co-tenant's BookmarkletImport primary key to POST /api/recipe-from-source/, the attacker causes the endpoint to return the victim's stored source URL and captured page content and then unconditionally delete that pending record, yielding limited confidentiality loss and a low-impact availability/denial effect against the victim's import workflow. Exploitation requires a valid account in the same shared Space as the victim (CVSS 3.1 5.4, PR:L, no user interaction), exposing only multi-member deployments; single-user or non-shared Spaces are not affected, and no public exploit code was identified at time of analysis.
Tandoor Recipes prior to version 2.6.4 allows authenticated users to inject malicious CSS via <style> tags in recipe step instructions due to improper sanitization by the bleach.clean() library, which whitelists <style> tags by default. Client applications rendering the instructions_markdown field from the API without additional sanitization will execute attacker-controlled CSS, enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration attacks. The vulnerability requires authentication and user interaction to exploit, limiting its scope, but affects any downstream application consuming the API.
Tandoor Recipes versions prior to 2.6.0 allow authenticated remote attackers to cause denial of service by injecting URL parameters into the USDA FoodData Central search endpoint through improper URL encoding of the query parameter, enabling API key override and server crashes via malformed requests. Publicly available exploit code exists, and a vendor-released patch is available in version 2.6.0.
Tandoor Recipes versions prior to 2.6.0 fail to strip EXIF metadata from WebP and GIF image uploads, exposing sensitive information such as GPS coordinates, timestamps, and camera details to all users viewing shared recipes. This information disclosure vulnerability affects any user uploading recipe photos, particularly those using modern smartphones that default to WebP format. The vulnerability is fixed in version 2.6.0.
Tandoor Recipes versions prior to 2.6.0 allow authenticated admin users to bypass space isolation controls and trigger synchronization operations on Sync configurations belonging to other organizational spaces, exposing the ability to initiate Dropbox, Nextcloud, or local imports outside the attacker's own space and access resulting sync logs. The vulnerability stems from missing space validation in the `SyncViewSet.query_synced_folder()` API endpoint, enabling horizontal privilege escalation across multi-tenant deployments. No public exploit code has been identified at the time of analysis.
Authenticated blind server-side request forgery in Tandoor Recipes before 2.6.10 allows a user with privileges to create a Space and configure an AI provider URL to force the server to connect to arbitrary internal addresses. The AI actions behind TARGET/api/ai-import/ and api/ai-step-sort/ pass the attacker-supplied provider URL straight to LiteLLM, bypassing the application's safe_request outbound filtering, and the resulting connection success, refusal, or timeout is surfaced as a reachability oracle that can be used to map internal hosts, ports, and cloud metadata endpoints. Exploitation requires an authenticated account (PR:L) and the AI provider feature to be in use, and exposure is limited to a blind oracle rather than confirmed response-body exfiltration; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Broken object-level authorization in Tandoor Recipes before 2.6.12 lets an authenticated member of the same Space, holding read and write API scope, read and silently alter another member's private recipe instructions and ingredients by supplying those private step or ingredient identifiers to the Step/Ingredient API. The affected sub-resource ViewSets (StepViewSet, IngredientViewSet) filter only on active Space and apply role-level CustomIsUser checks instead of the private-recipe owner/sharing predicate, so a co-tenant is accepted without recipe-level authorization. No public exploit code has been identified at time of analysis, and the flaw requires legitimate write-scoped credentials in the victim's Space; it is fixed in version 2.6.12.
An authenticated member of a shared Space in Tandoor Recipes prior to 2.6.10 can reach another member's private recipes - including reading private recipe files, sending those file bytes to the configured AI provider, and generating external or public share links - by supplying the victim's recipe identifier to the api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, or api/share-link/ endpoints, because those flows retrieve Recipe objects without invoking the private-recipe owner/sharing check (CustomRecipePermission). The prerequisite is an account already inside the same shared Space (Space sharing must be enabled) plus knowledge or enumeration of the target recipe ID, so single-user or non-shared deployments are not exposed; scoring is CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) with confidentiality as the dominant impact and no public exploit identified at time of analysis. The issue is fixed in 2.6.10.
Unauthenticated API input validation flaws in Tandoor Recipes (<2.6.4) enable cross-tenant data leakage and denial of service. The /api/food/{id}/shopping/ endpoint accepts unvalidated amount and unit parameters, allowing attackers to cause application crashes via malformed numeric inputs (HTTP 500 errors) and leak foreign-key references across multi-tenant Space boundaries by associating unit IDs from other tenants. CVSS 7.3 reflects network-accessible, low-complexity attacks requiring no authentication. No public exploit identified at time of analysis, though exploitation is straightforward via direct API calls. EPSS data not available. Vendor-released patch: version 2.6.4.
Privilege escalation in Tandoor Recipes prior to version 2.6.4 allows authenticated users with read-only shared access to recipe books to perform unauthorized write and delete operations. The CustomIsShared permission class incorrectly permits DELETE, PUT, and PATCH methods without validating safe HTTP methods, enabling shared users to overwrite or delete recipe books despite having semantically read-only permissions. This represents a high-severity authorization bypass with CVSS 8.1 (AV:N/AC:L/PR:L) requiring authenticated access but no user interaction. No public exploit identified at time of analysis, though the vulnerability affects a specific permission boundary and could be easily exploited by any user granted shared access.
Authenticated users can modify and expose private recipes in Tandoor Recipes through broken object-level authorization in the batch update API endpoint. Any authenticated user within a shared Space can modify recipes marked private by other users, force-share private recipes, and tamper with metadata by exploiting the PUT /api/recipe/batch_update/ endpoint which bypasses authorization checks enforced on single-recipe endpoints. Affects all versions prior to 2.6.4. CVSS 8.1 (High) reflects network-accessible attack requiring only low-privilege authentication with no user interaction. No public exploit identified at time of analysis, though exploitation is straightforward for authenticated attackers.
Tandoor Recipes versions prior to 2.6.0 allow unlimited brute-force password guessing attacks against any known username through API endpoints accepting BasicAuthentication headers. While Django AllAuth rate limiting protects the HTML login form (5 attempts per minute per IP), API endpoints completely bypass these controls, enabling high-speed credential stuffing with no account lockout. A proof-of-concept exploit exists and the attack is automatable per SSVC analysis, though no active exploitation is confirmed in CISA KEV.
Tandoor Recipes application versions prior to 2.6.0 expose complete database schema and access control logic through an undocumented debug parameter in the Recipe API endpoint, allowing any authenticated user to extract raw SQL queries including table structures, JOIN relationships, WHERE conditions, and multi-tenant space identifiers even in production environments with DEBUG=False. A proof-of-concept exploit is available (SSVC exploitation status: poc). The CVSS 4.0 score of 7.7 reflects network-based exploitation with no attack complexity, and SSVC indicates the vulnerability is automatable with partial technical impact.
Tandoor Recipes versions through 2.5.3 permit Host header injection attacks that enable invite link poisoning, allowing authenticated administrators with high privileges to be social-engineered into sending system-generated invite tokens to attacker-controlled servers. The Django application's default ALLOWED_HOSTS='*' configuration fails to validate HTTP Host headers, which combined with request.build_absolute_uri() usage allows manipulation of all absolute URLs including invite emails, API pagination, and OpenAPI schemas. No public exploit identified at time of analysis; CVSS 8.1 reflects network-based attack requiring high privileges and user interaction with changed scope.
Server-side request forgery in the Pestle importer of Tandoor Recipes through 2.6.15 allows an authenticated user with only the standard space 'user' role to make the server issue GET requests to arbitrary internal or external hosts by supplying a crafted image URL in a Pestle JSON import. It is a genuine but moderate-priority issue rather than a top-tier emergency: the flaw is reachable through POST /api/import/ with type=PESTLE, a default-available feature since v2.6.15, and the advisory documents a PoC with reproduced loopback fetch and storage of the internal response as a recipe image. No CISA KEV listing accompanies this CVE in the supplied data; 2.7.0 is the vendor-released fix.
Tandoor Recipes deployments prior to 2.6.10 can be driven into denial of service by an authenticated user who stores a catastrophic-backtracking regular expression in a shared-Space Automation rule, which the server then evaluates with Python's re.sub() during another user's recipe import through the api/recipe-from-source/ endpoint. Because the pattern is executed without complexity validation or any execution timeout, a single crafted rule can monopolize a Gunicorn worker until the request timeout elapses, exhausting available worker slots and making the application unavailable to legitimate users. Exploitation requires a valid authenticated account that belongs to a shared Space plus a second user importing a matching recipe (CVSS 5.7, CWE-1333, AV:N/AC:L/PR:L/UI:R with availability-only impact), no public exploit code has been identified at time of analysis, and the vendor shipped a fix in 2.6.10.
Tandoor Recipes instances running versions prior to 2.6.10 let any authenticated user infer sensitive database values - including password hashes, email addresses, and administrator status - by supplying crafted sort_order or order_field values that Django's ORM resolves as double-underscore foreign-key traversal paths during recipe search and RecipeBook ordering. The exposure is scored 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-943), with confidentiality impact rated High but reach constrained by the need for valid credentials and the indirect, oracle-style nature of the leak. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
An insecure direct object reference (IDOR/BOLA) in Tandoor Recipes prior to 2.6.10 lets an authenticated member of a shared Space read and destroy another member's pending bookmarklet import. By submitting a co-tenant's BookmarkletImport primary key to POST /api/recipe-from-source/, the attacker causes the endpoint to return the victim's stored source URL and captured page content and then unconditionally delete that pending record, yielding limited confidentiality loss and a low-impact availability/denial effect against the victim's import workflow. Exploitation requires a valid account in the same shared Space as the victim (CVSS 3.1 5.4, PR:L, no user interaction), exposing only multi-member deployments; single-user or non-shared Spaces are not affected, and no public exploit code was identified at time of analysis.
Tandoor Recipes prior to version 2.6.4 allows authenticated users to inject malicious CSS via <style> tags in recipe step instructions due to improper sanitization by the bleach.clean() library, which whitelists <style> tags by default. Client applications rendering the instructions_markdown field from the API without additional sanitization will execute attacker-controlled CSS, enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration attacks. The vulnerability requires authentication and user interaction to exploit, limiting its scope, but affects any downstream application consuming the API.
Tandoor Recipes versions prior to 2.6.0 allow authenticated remote attackers to cause denial of service by injecting URL parameters into the USDA FoodData Central search endpoint through improper URL encoding of the query parameter, enabling API key override and server crashes via malformed requests. Publicly available exploit code exists, and a vendor-released patch is available in version 2.6.0.
Tandoor Recipes versions prior to 2.6.0 fail to strip EXIF metadata from WebP and GIF image uploads, exposing sensitive information such as GPS coordinates, timestamps, and camera details to all users viewing shared recipes. This information disclosure vulnerability affects any user uploading recipe photos, particularly those using modern smartphones that default to WebP format. The vulnerability is fixed in version 2.6.0.
Tandoor Recipes versions prior to 2.6.0 allow authenticated admin users to bypass space isolation controls and trigger synchronization operations on Sync configurations belonging to other organizational spaces, exposing the ability to initiate Dropbox, Nextcloud, or local imports outside the attacker's own space and access resulting sync logs. The vulnerability stems from missing space validation in the `SyncViewSet.query_synced_folder()` API endpoint, enabling horizontal privilege escalation across multi-tenant deployments. No public exploit code has been identified at the time of analysis.