A high-severity authorization flaw in Tandoor Recipes allows authenticated users with shared read-only access to perform unauthorized modifications or deletions of sensitive recipe data.

The vulnerability exists in the RecipeBookViewSet and RecipeBookEntryViewSet classes, which fail to validate HTTP methods against the CustomIsShared permission class. Consequently, any authenticated user with shared access can execute write operations, such as PUT, PATCH, or DELETE, on objects intended to be read-only.

The exploitation of this vulnerability leads to a significant loss of data integrity and availability within the application, as unauthorized users can delete or overwrite entire recipe collections. With a CVSS score of 8.1, the risk is substantial, potentially resulting in operational disruption and the loss of proprietary culinary data for organizations relying on the platform.

Immediate Action: Upgrade Tandoor Recipes to version 2.6.4 or later to apply the necessary permission checks that restrict write operations to authorized users only.

Proactive Monitoring: Review application access logs for unexpected DELETE, PUT, or PATCH requests originating from accounts that should only possess read-only permissions.

Compensating Controls: Implement strict network-level access controls or a Web Application Firewall to monitor and filter unauthorized API calls to the affected ViewSet endpoints until the update can be applied.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for total data loss within affected recipe books, administrators must prioritize this update. Applying the 2.6.4 patch is the only definitive method to ensure that shared access remains restricted to read-only as intended by the application logic.