CVE-2026-112342 Details
Description
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.
A vulnerability in Tandoor Recipes versions prior to 2.7.0 allows authenticated users to exploit an improper cache-key design in the permission management system. The issue arises because the cache key for group-based permissions is based solely on user ID, without considering the active space. This flaw enables users to retain outdated permissions when switching spaces, particularly if they have administrative rights in one space and lesser privileges in another. The vulnerability can be exploited by creating a new space, obtaining admin rights, and then switching to a different space where those rights should not apply, effectively bypassing permission revocations.
Users can update to Tandoor Recipes version 2.7.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TandoorRecipes/recipes/commit/1285f5009aa166c0d6f8658849eed5686294d5e9 | [email protected] | Source CodeVendor |
| https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0 | [email protected] | Release NotesVendor |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-69q3-5q6x-7hmx | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/tandoor-recipes-cross-space-permission-cache-poisoning | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tandoor Recipes | < 2.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |