CVE-2026-61726 TandoorRecipes CVE debrief

Who should care

Defenders of Tandoor Recipes instances, Space administrators, and users with read and write API scope should assess exposure and take action. This includes verifying instance exposure, upgrading to version 2.6.12 or later, reviewing and updating access controls for Space members, and monitoring for suspicious activity on the /api/step/ endpoint.

Why it matters

CVE-2026-61726 is a high-severity vulnerability in Tandoor Recipes that allows authenticated users to read and modify private recipe content of other Space members. Defenders should prioritize verifying exposure and upgrading to version 2.6.12 or later.

• Read and modify private recipe content of other Space members
• Bypass authorization for /api/step/ endpoint
• Potential data exposure and integrity loss

Technical summary

Tandoor Recipes application versions before 2.6.12 have an authorization bypass vulnerability in the /api/step/ endpoint. This vulnerability allows authenticated users with read and write API scope to read and modify private recipe content of other Space members. The issue arises from the sub-resource querysets returning and updating private-recipe steps for non-owners due to Space membership acceptance without recipe-level authorization. The vulnerability is fixed in version 2.6.12, and defenders should prioritize verifying exposure and upgrading to this version.

Defensive priority

Defenders should prioritize verifying exposure of Tandoor Recipes instances and upgrading to version 2.6.12 or later.

Recommended defensive actions

• Verify Tandoor Recipes instance exposure and upgrade to version 2.6.12 or later
• Review and update access controls for Space members
• Monitor for suspicious activity on /api/step/ endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, affected versions, and fixed version. The vulnerability allows authenticated users to bypass authorization and read or modify private recipe content of other Space members. Evidence is based on CVE Program and NVD records, with limitations on source-provided details. Defenders should verify exposure and upgrade to version 2.6.12 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.