CVE-2026-28503: Tandoor Recipes Auth Bypass Vulnerability

CVE-2026-28503 Overview

CVE-2026-28503 is an Insecure Direct Object Reference (IDOR) vulnerability in Tandoor Recipes, an open-source application for managing recipes, planning meals, and building shopping lists. The vulnerability exists in versions prior to 2.6.0 where the SyncViewSet.query_synced_folder() action in cookbook/views/api.py (line 903) fetches a Sync object using get_object_or_404(Sync, pk=pk) without including space=request.space in the filter. This authorization bypass allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs.

Critical Impact

Administrative users can access and trigger sync operations across tenant boundaries, potentially exposing sensitive recipe data and sync configurations from other spaces.

Affected Products

• Tandoor Recipes versions prior to 2.6.0

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-28503 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-28503

Vulnerability Analysis

This vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key, a type of Insecure Direct Object Reference (IDOR) flaw. The core issue stems from insufficient access control validation in the sync functionality of the Tandoor Recipes application.

Tandoor Recipes implements a multi-tenant architecture using "Spaces" to isolate different users' data. Each Space should only be able to access and manage its own resources, including sync configurations for external services like Dropbox, Nextcloud, or local file systems.

The vulnerable code path in cookbook/views/api.py at line 903 retrieves Sync objects based solely on the primary key (pk) parameter without validating that the requested Sync configuration belongs to the requesting user's Space. This allows an authenticated admin user to manipulate the pk parameter to reference Sync configurations from other Spaces, effectively bypassing the tenant isolation controls.

Root Cause

The root cause is a missing authorization check in the SyncViewSet.query_synced_folder() method. The function uses get_object_or_404(Sync, pk=pk) to fetch Sync objects but fails to include the space=request.space filter that would ensure the object belongs to the authenticated user's Space. This oversight allows cross-tenant access to sync operations and their associated logs.

Attack Vector

An attacker with administrative privileges in one Space can exploit this vulnerability over the network by manipulating API requests to the sync endpoint. By enumerating or guessing valid Sync configuration IDs, the attacker can:

1. Trigger sync operations on external storage configurations (Dropbox, Nextcloud, Local) belonging to other Spaces
2. View sync logs that may contain sensitive information about other tenants' configurations and imported data
3. Potentially import or manipulate recipe data across tenant boundaries

The attack requires no user interaction and can be performed by any authenticated admin user, making it a horizontal privilege escalation issue within the multi-tenant environment.

Detection Methods for CVE-2026-28503

Indicators of Compromise

• Unexpected sync operations triggered on Sync configurations not owned by the requesting user's Space
• API requests to sync endpoints with pk values referencing Sync objects from different Spaces
• Anomalous access patterns in sync logs showing cross-Space references
• Audit log entries indicating admin users accessing resources outside their assigned Space

Detection Strategies

• Monitor API access logs for SyncViewSet.query_synced_folder() calls with unusual pk parameter patterns
• Implement detection rules for cross-Space resource access attempts in application logs
• Review audit trails for sync operations that reference configurations from multiple Spaces by the same user
• Alert on repeated enumeration attempts against the sync API endpoints

Monitoring Recommendations

• Enable detailed logging for all sync-related API endpoints to capture Space context
• Implement alerting for any sync operations where the requesting user's Space differs from the Sync configuration's Space
• Regularly audit sync logs for signs of unauthorized cross-tenant access
• Deploy application-level monitoring to detect IDOR attack patterns on sensitive endpoints

How to Mitigate CVE-2026-28503

Immediate Actions Required

• Upgrade Tandoor Recipes to version 2.6.0 or later immediately
• Review sync operation logs for evidence of cross-Space access prior to patching
• Audit all Sync configurations to ensure no unauthorized modifications were made
• Consider temporarily disabling sync functionality if immediate upgrade is not possible

Patch Information

The vulnerability has been addressed in Tandoor Recipes version 2.6.0. The patch adds proper Space-based filtering to the query_synced_folder() method to ensure Sync objects are only accessible within their owning Space context. Users should upgrade to version 2.6.0 or later to remediate this vulnerability.

For detailed patch information, refer to the GitHub Release Notes and the GitHub Security Advisory.

Workarounds

• Restrict admin access to trusted users only until the patch can be applied
• Implement network-level access controls to limit who can reach the Tandoor Recipes API
• Use a Web Application Firewall (WAF) to monitor and filter suspicious sync API requests
• Disable sync functionality entirely if it is not required for operations