CVE-2026-61726

The Tandoor Recipes application (prior to version 2.6.12 ) contains an authorization bypass in the StepViewSet and IngredientViewSet components. The root cause is that these components filter by active Space and use role-level CustomIsUser checks without verifying private-recipe ownership or shar...

PT-2026-116142

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...