CVE-2026-28503 PUBLISHED

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

Assigner: GitHub_M
Reserved: 27.02.2026 Published: 26.03.2026 Updated: 27.03.2026

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the SyncViewSet.query_synced_folder() action in cookbook/views/api.py (line 903) fetches a Sync object using get_object_or_404(Sync, pk=pk) without including space=request.space in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 5.5

Product Status

Vendor TandoorRecipes
Product recipes
Versions
  • Version < 2.6.0 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE