CVE-2026-61726

Received Received - Intake

Stored XSS in Tandoor Recipes via StepViewSet

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-61726

EUVD

EUVD-2026-103144

Affected Vendors & Products

Vendor	Product	Version / Range
TandoorRecipes	recipes	< 2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Tandoor Recipes before 2.6.12 allows authenticated users with API access to read or modify private recipe steps of other members in the same Space. The issue occurs because the StepViewSet and IngredientViewSet only check Space membership and not recipe ownership when accessing steps.

Detection Guidance

This vulnerability involves improper authorization checks in Tandoor Recipes versions prior to 2.6.12. To detect it, verify the installed version of Tandoor Recipes and check for unauthorized access to private recipe steps or ingredients within the same Space. No specific commands are provided in the context.

Impact Analysis

If you use Tandoor Recipes before 2.6.12, an attacker with API access in your Space could silently view or alter your private recipe instructions without your knowledge. This could lead to data leaks or unintended changes to your recipes.

Compliance Impact

This vulnerability could violate GDPR by exposing private recipe data without consent and HIPAA if recipe steps contain health-related information. Unauthorized modifications to recipes may also breach integrity requirements.

Mitigation Strategies

Upgrade Tandoor Recipes to version 2.6.12 or later to address the vulnerability. Ensure all users with access to private recipes are verified for proper authorization.

Hi! I’m here to help you understand CVE-2026-61726. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70