---
id: CVE-2026-112342
title: Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning
summary: >-
  Tandoor Recipes before 2.7.0 contains an improper cache-key design in
  cookbook/helper/permission_helper.py that allows authenticated users to retain
  stale group-based permissions across different spaces by exploiting a cache
  key keyed on…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: Tandoor Recipes
product: Tandoor Recipes
affected:
  - tandoor_recipes < 2.7.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T20:43:50.317509Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:55:58.119Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112342'
references:
  - url: >-
      https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-69q3-5q6x-7hmx
    label: GitHub Security Advisory (GHSA-69q3-5q6x-7hmx)
  - url: 'https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0'
    label: Release Notes
  - url: >-
      https://github.com/TandoorRecipes/recipes/commit/1285f5009aa166c0d6f8658849eed5686294d5e9
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/tandoor-recipes-cross-space-permission-cache-poisoning
    label: >-
      VulnCheck Advisory: Tandoor Recipes < 2.7.0 Cross-Space Permission Cache
      Poisoning
tags:
  - cve.org
ingestedAt: '2026-10-23T18:33:40.923Z'
---

## Overview

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.

## Affected

- `tandoor_recipes < 2.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.