Tandoor Recipes CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Tandoor Recipes CVE published 2026-10-23

CVE-2026-112342

Tandoor Recipes versions before 2.7.0 are vulnerable to cross-space permission cache poisoning. Authenticated users can exploit this by retaining stale group-based permissions across different spaces, allowing for elevated access and bypassing group revocations or demotions. This vulnerability is caused by an improper cache-key design in cookbook/helper/permission_helper.py, which enables attackers to cre [truncated]