CVE-2026-61726

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-61726

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-61726 Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-61726 Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-61726

The Tandoor Recipes application (prior to version 2.6.12 ) contains an authorization bypass in the StepViewSet and IngredientViewSet components. The root cause is that these components filter by active Space and use role-level CustomIsUser checks without verifying private-recipe ownership or shar...

EUVD-2026-103144

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-61726 Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

PT-2026-116142

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-61726: Improper Access Control

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

Tandoor Recipes: Permissions, licensing, and access control issues

Versions of Tandoor Recipes prior to 2.6.12 have security vulnerabilities. This vulnerability arises from the fact that the StepViewSet and IngredientViewSet only filter by activity space, and they use role-level CustomIsUser checks instead of private recipe owners or shared predicates. When...