A critical authorization bypass vulnerability in Tandoor Recipes allows authenticated users to manipulate private recipe data, potentially leading to unauthorized data exposure and modification.

The application fails to perform adequate object level authorization checks on the PUT /api/recipe/batch_update/ endpoint, allowing any authenticated user within a Space to modify recipes regardless of their private status.

This vulnerability poses a significant risk to data confidentiality and integrity by permitting unauthorized users to view or alter sensitive recipe content. Given the CVSS score of 8.1, the flaw represents a high-severity risk that could lead to widespread exposure of private user information and the corruption of shared recipe databases, resulting in potential reputational harm and loss of user trust.

Immediate Action: Upgrade Tandoor Recipes to version 2.6.4 or later immediately to apply the necessary object level authorization checks.

Proactive Monitoring: Review application access logs for unusual activity targeting the /api/recipe/batch_update/ endpoint, specifically looking for bulk update requests originating from non-administrative user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to the /api/recipe/batch_update/ endpoint to known, authorized service accounts or administrative roles until the patch can be deployed.

Public Exploit Available: No

The authorization bypass in Tandoor Recipes requires immediate attention due to the ease with which authenticated users can circumvent privacy controls. Organizations should prioritize patching to version 2.6.4 to restore object level security and prevent unauthorized modification or exposure of private data.