---
id: "CVE-2026-61726"
kind: "vulnerability"
aliases: ["CVE-2026-61726"]
title: "Tandoor Recipes: Step API lets same-Space members read and edit private recipes"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["django", "package", "python", "self-hosted", "tandoor-recipes"]
not_affected_if: ["single-user-space", "version-2.6.12-or-later"]
published_at: "2026-10-16T20:17:23+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:06:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61726", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Tandoor Recipes: Step API lets same-Space members read and edit private recipes

Tandoor Recipes' step and ingredient API endpoints check only Space membership, not recipe ownership or sharing, before returning or updating a recipe's steps. An authenticated member of a Space can read and silently modify another member's private recipe instructions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Tandoor version (for example `docker exec <container> python -c "import recipes; print(recipes.__version__)"` or the image tag), and compare it to `2.6.12`
- unknown for any other check, as the sources do not give one

## Fix

- Upgrade Tandoor Recipes to `2.6.12` or later
- Until upgraded, restrict API tokens with read and write scope to trusted users (unknown whether this fully mitigates)

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61726

## From the sources

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_