Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.
CVE-2026-112342
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-112342
Tandoor Recipes
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/TandoorRecipes/recipes",
"vendor": "Tandoor Recipes",
"product": "Tandoor Recipes",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.7.0",
"versionType": "semver"
}
],
"packageURL": "pkg:github/TandoorRecipes/recipes",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-112342
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #53229 · Revision 1
- Added to Heist Feed
- Publisher date