CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.
Засегнати продукти
- TandoorRecipes recipes: < 2.6.12
Вид слабост
История
- 16 октомври 2026 Публикувано
Други уязвимости в TandoorRecipes recipes
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-61726
- https://nvd.nist.gov/vuln/detail/CVE-2026-61726
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-wjf3-fq5w-7j7w
- https://github.com/TandoorRecipes/recipes/commit/3c5678f663e62e6ddf3d7df0b2bcc89ce2f52def
- https://github.com/TandoorRecipes/recipes/releases/tag/2.6.12