CVE-2026-61726

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61726
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61726.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61726
Aliases
  • GHSA-wjf3-fq5w-7j7w
Published
2026-10-16T19:19:57Z
Modified
2026-10-21T02:58:52Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
Details

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-284",
        "CWE-639",
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61726.json"
}
References

Affected packages

Git / github.com/tandoorrecipes/recipes

Affected ranges

Type
GIT
Repo
https://github.com/tandoorrecipes/recipes
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bf3a5a6b378669783bc6558b53be206540ea83d9
Fixed
3c5678f663e62e6ddf3d7df0b2bcc89ce2f52def
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.6.12"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "3c5678f663e62e6ddf3d7df0b2bcc89ce2f52def"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "2.6.12",
            "range":  [
                {
                    "fixed":  "bf3a5a6b378669783bc6558b53be206540ea83d9"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.12.0
0.12.1
0.13.0
0.15.0
0.15.1
0.15.2
0.16.0
0.17.1
0.17.2
0.17.3
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.1
0.9.0
0.9.1
0.9.2
1.*
1.0.3
1.1.3
1.1.4
1.2.4
1.2.5
1.5.11
2.*
2.0.0-alpha-1
2.0.0-alpha-2
2.0.0-alpha-3
2.0.0-alpha-4
2.0.0-alpha-5
2.0.0-alpha-6
2.2.7
2.3.0
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.10
2.6.11
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61726.json"