CVE-2026-112342

HIGH 7.1

Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.

CWE	CWE-863
Vendor	tandoor recipes
Product	tandoor recipes
Published	Oct 23, 2026

Stay Ahead of the Next One

Get instant alerts for tandoor recipes tandoor recipes

Be the first to know when new high vulnerabilities affecting tandoor recipes tandoor recipes are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

Tandoor Recipes / Tandoor Recipes

0 < 2.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-69q3-5q6x-7hmx github.com: https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0 github.com: https://github.com/TandoorRecipes/recipes/commit/1285f5009aa166c0d6f8658849eed5686294d5e9 vulncheck.com: https://www.vulncheck.com/advisories/tandoor-recipes-cross-space-permission-cache-poisoning

Credits

m0usem0use