Key points
- CVE-2026-61726 carries a CVSS score of 8.1, rated high severity.
- The flaw affects Tandoor Recipes versions prior to 2.6.12.
- Attackers can read and modify private recipe steps within the same space.
Tandoor Recipes users running versions earlier than 2.6.12 must apply an update immediately. The vendor has released version 2.6.12, which resolves a high-severity authorization flaw. This patch addresses CVE-2026-61726, a vulnerability that allows authenticated users with read and write API scope to access private data belonging to other members of their shared space.
In plain English
The application failed to properly check whether a user owned a specific private recipe before allowing them to view or change its steps. While the system correctly verified that the user belonged to the same general space, it did not enforce stricter permissions for individual private items. This oversight meant that any member with standard API access could bypass ownership checks.
The background
According to the National Vulnerability Database, the issue stems from how StepViewSet and IngredientViewSet handle authorization. These components relied on role-level checks rather than verifying the private-recipe owner or sharing predicates. Consequently, sub-resource queries returned and updated private recipe steps for non-owners, provided they were in the same space. Cross-space access remained unaffected by this specific logic error.
What changes now
Version 2.6.12 corrects the authorization logic to ensure that users can only access or modify steps for recipes they own or have explicit sharing permissions for. The fix tightens the validation process used by the Step API endpoints. Users who upgrade will no longer be able to silently modify another same-space member's private recipe instructions.
Who needs to act first
Teams should prioritize updating publicly accessible instances first, as these face the highest exposure risk. Before applying the patch to production environments, administrators should test the update in a staging area to ensure compatibility with existing data. It is also prudent to back up the current database and configuration files. If immediate updating is not possible, restrict API access to trusted internal networks only.
What to do and how to stay safe: Tandoor Recipes
- Verify your current Tandoor Recipes version and compare it against the fixed release.
- Review API access logs for unusual activity involving private recipe endpoints.
- Apply the vendor-provided update to all affected instances as soon as possible.
- Educate users about the importance of keeping recipe management tools updated.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-61726?
The vulnerability has a CVSS score of 8.1, which is rated as high severity.
Which versions of Tandoor Recipes are affected?
All versions prior to 2.6.12 are affected by this authorization flaw.
Can users from different spaces access private recipes?
No, cross-space access remains out of scope for this specific vulnerability.
