Live › vulnerability › CVE-2026-112342
Go to dashboardTandoor Recipes before 2.7.0 caches group permissions by user ID without the active space, so a cached admin decision carries over when a user switches spaces. An authenticated user can use this to reach elevated actions in a space where they were demoted or have lesser rights.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Tandoor Recipes instances before 2.7.0 where users can hold accounts in more than one space, including users who can create their own space. Single-space instances with trusted users carry less exposure.
No product ranges from the sources yet.
2.7.0cookbook/helper/permission_helper.py for a cache key built only from the user id2.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.
This page as .md · .json · in your agent: get_signal("CVE-2026-112342")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.