PT-2026-28380 · Unknown · Tandoor Recipes

Vabene1111 · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-28503

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.0

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the SyncViewSet.query synced folder() action in cookbook/views/api.py (line 903) fetches a Sync object using get object or 404(Sync, pk=pk) without including space=request.space in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. The API endpoint involved is SyncViewSet.query synced folder(). The vulnerable parameter is pk.

Recommendations Update to version 2.6.0 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-28503

GHSA-6QPW-GWCQ-68FV

Produtos afetados

Tandoor Recipes

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28503.json · Exploit
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6qpw-gwcq-68fv · Aviso do Fabricante
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28503 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037280593470513170 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28503 · Aviso do Fabricante