CVE-2026-61726: Tandoor Recipes Auth Bypass Vulnerability

CVE-2026-61726 Overview

CVE-2026-61726 is a broken access control vulnerability in Tandoor Recipes, an open-source application for managing recipes, planning meals, and building shopping lists. Prior to version 2.6.12, the StepViewSet and IngredientViewSet endpoints filter requests only by the active Space and apply role-level CustomIsUser checks. These checks omit the private-recipe owner and sharing predicate. An authenticated user with read and write API scope in a victim's Space can read and silently modify another member's private recipe instructions by supplying private recipe or step identifiers to the Step API. Cross-Space access remains out of scope. The issue is fixed in version 2.6.12.

Critical Impact
Any authenticated member of a shared Space can bypass private-recipe authorization to read and modify another user's private recipe steps and ingredients through api/step/ and related sub-resource endpoints.

Affected Products

Tandoor Recipes versions prior to 2.6.12
StepViewSet and IngredientViewSet API endpoints
Deployments where multiple users share a single Space

Discovery Timeline

2026-10-16 - CVE-2026-61726 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-61726

Vulnerability Analysis

The flaw is a broken access control defect classified as [CWE-284]. The StepViewSet and IngredientViewSet querysets scope results by the authenticated user's active Space and verify role via CustomIsUser. They do not apply the CustomRecipePermission predicate that enforces private-recipe ownership or explicit sharing. As a result, sub-resource endpoints such as api/step/ and api/step/{step_id}/ return and update step and ingredient records belonging to private recipes owned by other Space members. The attacker needs only a valid authenticated session with read and write API scope inside the victim's Space.

Root Cause

Authorization is enforced at the Space membership layer rather than at the recipe layer. The sub-resource querysets inherit the Space filter but never check whether the parent recipe is marked private=True and whether the requesting user is the created_by owner or appears in the shared set. Space membership is implicitly treated as sufficient authorization for every recipe reachable within that Space.

Attack Vector

An authenticated attacker inside the same Space enumerates or guesses step identifiers and issues GET or PATCH requests to api/step/{step_id}/ or the ingredient endpoint. The server returns private step data or persists modifications without validating recipe ownership. The attack requires low privileges and no user interaction, and it affects confidentiality and integrity of private recipe content.

python

# Patch excerpt from cookbook/views/api.py
# Adds private-recipe ownership and sharing predicate to the queryset
                                                  Prefetch('unit__unit_conversion_base_relation', queryset=unit_conversion_qs),
                                                  Prefetch('unit__unit_conversion_converted_relation', queryset=unit_conversion_qs),
                                                  'step_set',
-                                                  'step_set__recipe_set', ).filter(step__recipe__space=self.request.space)
+                                                  'step_set__recipe_set', ).filter(step__recipe__space=self.request.space).filter(
+            Q(step__recipe__private=False) | (Q(step__recipe__private=True) & (Q(step__recipe__created_by=self.request.user) | Q(step__recipe__shared=self.request.user))))

Source: GitHub commit 3c5678f

Detection Methods for CVE-2026-61726

Indicators of Compromise

Unexpected PATCH or PUT requests to api/step/{step_id}/ or api/ingredient/ endpoints originating from accounts that do not own the parent recipe.
Audit log entries showing step or ingredient modifications where the modifying user is not the recipe's created_by owner and is not listed in shared.
Enumeration patterns against sequential step identifiers from a single authenticated session.

Detection Strategies

Correlate API request logs with recipe ownership metadata to flag writes against private recipes by non-owners.
Add application-level logging that records the recipe.private flag and the requesting user alongside each step and ingredient mutation.
Review HTTP access logs for high-volume GET requests to api/step/ from a single session, which may indicate ID enumeration.

Monitoring Recommendations

Enable Django request logging on the Tandoor Recipes instance and ingest logs into a centralized SIEM for retention and query.
Alert on any 200-series response to api/step/{step_id}/ where the requesting user is not the recipe owner.
Track per-user rates of step and ingredient API calls to identify anomalous activity consistent with bulk access attempts.

How to Mitigate CVE-2026-61726

Immediate Actions Required

Upgrade Tandoor Recipes to version 2.6.12 or later, which applies the recipe-level ownership and sharing predicate.
Audit historical step and ingredient modification logs to identify unauthorized changes to private recipes.
Review Space membership and remove any accounts that should not have access to private content.

Patch Information

The fix is available in Tandoor Recipes v2.6.12. The patch adds a Q-expression filter on the step and ingredient querysets that enforces step__recipe__private=False or ownership and sharing checks on the parent recipe. See GHSA-wjf3-fq5w-7j7w for the full advisory.

Workarounds

Move private recipes into dedicated single-user Spaces until the upgrade can be applied, since cross-Space access is not affected.
Revoke write API scope from untrusted members of multi-user Spaces to limit silent modification.
Restrict network access to the Tandoor Recipes API to trusted users only via a reverse proxy or VPN.

bash

# Upgrade example for a Docker Compose deployment
docker compose pull
docker compose up -d
# Verify running image is at version 2.6.12 or later
docker compose exec web python -c "import cookbook; print(cookbook.VERSION)"