PT-2026-28380 · Unknown · Tandoor Recipes

Vabene1111 · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-28503

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.0

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the SyncViewSet.query synced folder() action in cookbook/views/api.py (line 903) fetches a Sync object using get object or 404(Sync, pk=pk) without including space=request.space in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. The API endpoint involved is SyncViewSet.query synced folder(). The vulnerable parameter is pk.

Recommendations Update to version 2.6.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-28503

GHSA-6QPW-GWCQ-68FV

Affected Products

Tandoor Recipes

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28503.json · Exploit
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6qpw-gwcq-68fv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28503 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28503 · Vendor Advisory
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 · Note
• https://twitter.com/CVEnew/status/2037280593470513170 · Twitter Post