CVE-2026-28503
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
Published Mar 26, 2026 · updated Jun 17, 2026 · tandoor recipes
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the action in (line 903) fetches a Sync object using without including in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the action in (line 903) fetches a Sync object using without including in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2
Jun 17, 2026 · NIST NVD
Updated
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the action in (line 903) fetches a Sync object using without including in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2
Affected
- cpe tandoor/recipesversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28503
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28503
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the action in (line 903) fetches a Sync object using witho
nvd.nist.gov