medium6.5
CVE-2026-28503
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
Impact
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncViewSet.query_synced_folder()` action in `cookbook/views/api.py` (line 903) fetches a Sync object using `get_object_or_404(Sync, pk=pk)` without including `space=request.space` in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tandoor | Recipes | before 2.6.0 |