Access Control Flaw in Tandoor Recipes Affects Private Recipe Management

CVE-2026-61726

What is CVE-2026-61726?

Tandoor Recipes, an application designed for managing recipes and meal planning, has revealed an access control vulnerability in versions prior to 2.6.12. This issue stems from the improper filtering of active users in secure areas of the application, particularly within StepViewSet and IngredientViewSet. With insufficient checks on private recipe ownership, authenticated users were able to access and modify private recipe instructions belonging to other users within the same space. This flaw allows unauthorized modifications to private data and raises significant concerns regarding user privacy and data integrity. The vulnerability has been addressed in version 2.6.12, ensuring more secure recipe management and user privacy.

References