{"id":"CVE-2026-61726","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-61726","generatedAt":"2026-10-28T11:20:58.234Z","title":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.","published":"2026-10-16T20:17:24.000Z","lastModified":"2026-10-19T20:52:47.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-284","CWE-639","CWE-863"],"affected":[],"epss":{"score":0.00231,"percentile":0.13832,"date":"2026-10-27","history":[{"date":"2026-10-17","score":0.00231,"percentile":0.12912}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-16T20:17:24.000Z","detail":{"score":"8.1","severity":"HIGH","publishedAt":"2026-10-16T20:17:23.980Z"},"summary":"New CVE, high severity (CVSS 8.1)."}],"references":[{"url":"https://github.com/TandoorRecipes/recipes/commit/3c5678f663e62e6ddf3d7df0b2bcc89ce2f52def","source":"security-advisories@github.com"},{"url":"https://github.com/TandoorRecipes/recipes/releases/tag/2.6.12","source":"security-advisories@github.com"},{"url":"https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-wjf3-fq5w-7j7w","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-61726","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}