CVE-2026-61726

The Tandoor Recipes application (prior to version 2.6.12 ) contains an authorization bypass in the StepViewSet and IngredientViewSet components. The root cause is that these components filter by active Space and use role-level CustomIsUser checks without verifying private-recipe ownership or shar...