Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112342— Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning

Quick assessment

Affected
Tandoor Recipes Tandoor Recipes
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tandoor Recipes 2.7.0 之前的版本在 cookbook/helper/permission_helper.py 中存在缓存键设计不当的漏洞。该漏洞允许已认证用户利用仅基于用户 ID 生成、却未包含当前活动空间的缓存键，在不同空间间保留过时的基于组的权限。由于缓存条目的生存时间（TTL）会在每次请求时刷新，攻击者可先创建自己的空间以获取管理员组身份，随后将活动空间切换至其仅拥有较低权限的目标空间。此时，系统会因缓存中残留的管理员权限判断而错误地授予 elevated（提升）访问权限，从而绕过跨多个

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Tandoor Recipes Tandoor Recipes < 2.7.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112342

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning
Source: CVE Program / CVE List V5
Vulnerability Description
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Tandoor Recipes Tandoor Recipes 0 ~ 2.7.0 -

II. Public POCs for CVE-2026-112342

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112342

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-112342 (2)

Vendor Pages for CVE-2026-112342 (1)

IV. Related Vulnerabilities

Same weakness: CWE-863

V. Comments for CVE-2026-112342

No comments yet

Leave a comment