CVE-2026-28503mediumCWE-639

CVE-2026-28503: medium-severity vulnerability in TandoorRecipes recipes

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

Published · Updated

Follow this CVE+ Monitor recipes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.3%
In short

An admin user can access and trigger sync operations (like file imports from Dropbox or Nextcloud) on recipe sync configurations that belong to other isolated workspaces, and view the sync logs. This breaks the intended isolation between separate workspace environments.

Technical detail

Tandoor Recipes prior to 2.6.0 lacks space scoping in SyncViewSet.query_synced_folder(), allowing an authenticated admin to bypass access controls via IDOR. The get_object_or_404(Sync, pk=pk) query omits the space=request.space filter, enabling cross-space sync operations and log retrieval across workspace boundaries.

Summary generated and translated by AI from the official description.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncViewSet.query_synced_folder()` action in `cookbook/views/api.py` (line 903) fetches a Sync object using `get_object_or_404(Sync, pk=pk)` without including `space=request.space` in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
TandoorRecipes · recipes
Related CVEs — TandoorRecipes recipes

In the same product, most dangerous first.

CVE-2025-23211CRITICALTandoor Recipes - SSTI - Remote Code ExecutionEPSS 3.7%CVE-2025-23212HIGHTandoor Recipes - Local file disclosure - Users can read the content of any file on the serverEPSS 0.5%CVE-2026-33152CRITICALTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationEPSS 0.5%CVE-2026-25964MEDIUMTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadEPSS 0.5%CVE-2026-33148MEDIUMURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyEPSS 0.5%CVE-2026-33153HIGHTandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control LogicEPSS 0.5%