CVE-2026-61726: Tandoor Recipes: Authorization bypass in Step API exposes private recipes

Summary

Tandoor Recipes is a self-hosted application for managing recipes, meal plans and shopping lists. The Step and Ingredient API endpoints check only Space membership and not the owner or sharing rules of private recipes. An authenticated user with read and write API access can therefore read and silently modify the instructions of a private recipe belonging to another member of the same Space. Cross-Space access is not affected.

Affected

Tandoor Recipes versions before 2.6.12
Vendor advisory lists affected versions as up to 2.6.11; a third-party record lists 2.6.0 to 2.6.12 (conflict, vendor data preferred)

Fixed in

Fixed in Tandoor Recipes 2.6.12 (released 30 June 2026 according to GitHub)
Newer releases are available; check the current release line before upgrading

Workaround

No vendor workaround known.
Limit Space membership to trusted users.
Restrict API tokens to read-only where write access is not needed.
Do not expose the instance to the public internet until it is upgraded.

Exploitation

Attacker needs a valid account in the same Space as the victim.
Vendor reports no exploitation in the wild; CISA SSVC lists PoC exploitation status.
Public PoC status is conflicting and unresolved.
Not listed in CISA KEV according to a third-party source (not verified).

Our recommendation

Identify all Tandoor Recipes instances.
Upgrade to version 2.6.12 at minimum, preferably to the current release line after checking the changelog.
Review Space memberships and API tokens.
Check whether instances are reachable from the internet.
Monitor the vendor advisory for updates.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

GitHub Security Advisory GHSA-wjf3-fq5w-7j7w github.com
Tandoor Recipes Release 2.6.12 github.com
Fix commit 3c5678f github.com
Mend record CVE-2026-61726 vulners.com
Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:52.

Original description (NVD)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed