CVE-2026-27460

Tandoor Recipes is a recipe manager that can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration (SQLite and default MEDIA_ROOT), the full database file may be externally accessible, potentially on the Internet, because the db.sqlite3 file is created in the same directory as MEDIA_ROOT.

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions.

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer. Authenticated low-privileged users can force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file.

Tandoor Recipes before 2.6.12 allows an authenticated user with read and write API scope in the victim's Space to access and modify another same-Space member's private recipe steps. The flaw is because StepViewSet and IngredientViewSet filter only by active Space and use role-level checks instead of the private-recipe owner or sharing predicate.

Tandoor Recipes before 2.6.10 passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks. An authenticated user can create a Space, configure an AI provider with a URL targeting an internal address, and invoke an AI action, enabling scanning of internal hosts and ports.

Tandoor Recipes prior to version 2.6.10 executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout. When an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe, the automation engine can occupy a Gunicorn worker until its request timeout, exhausting worker slots and making the service unavailable.

Tandoor Recipes before 2.6.10 allows an authenticated member of a shared Space to access another member's private recipes by supplying a private recipe identifier to AI import, file, external-link, or share-link endpoints. The flaw is due to missing object-level authorization, potentially leading to reading private recipe files, sending them to the AI provider, or creating public links.

In Tandoor Recipes prior to 2.6.10, the application looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. The endpoint returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import.

In Tandoor Recipes prior to 2.6.10, unvalidated sort_order and order_field strings are passed into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields.

Tandoor Recipes before 2.6.4 allows authenticated users to inject arbitrary <style> tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the <style> tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration.