CVE-2026-28503
Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404
In short
An admin user can access and trigger sync operations (like file imports from Dropbox or Nextcloud) on recipe sync configurations that belong to other isolated workspaces, and view the sync logs. This breaks the intended isolation between separate workspace environments.
Technical detail
Tandoor Recipes prior to 2.6.0 lacks space scoping in SyncViewSet.query_synced_folder(), allowing an authenticated admin to bypass access controls via IDOR. The get_object_or_404(Sync, pk=pk) query omits the space=request.space filter, enabling cross-space sync operations and log retrieval across workspace boundaries.
Summary generated and translated by AI from the official description.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncViewSet.query_synced_folder()` action in `cookbook/views/api.py` (line 903) fetches a Sync object using `get_object_or_404(Sync, pk=pk)` without including `space=request.space` in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
TandoorRecipes · recipesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →