The vulnerability resides in an improper cache-key design within the permission helper module of Tandoor Recipes versions prior to 2.7.0, where the cache key uses only the user identifier and ignores the active space context, allowing stale permission data to persist while its TTL is refreshed on each request. Consequently, an authenticated attacker can create a space where they are granted an admin group, then switch to a target space and use the stale cached admin decision to bypass group revocations or demotions, granting unauthorized elevated access across multiple permission classes and views.

Systems running the Tandoor Recipes application, version 2.6.x and earlier, are affected. The issue specifically targets the helper code that resolves user permissions across different working spaces and does not impact later releases (2.7.0 and above).

The CVSS score of 7.1 indicates a medium‑to‑high severity vulnerability. Although the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, it is exploitable by any authenticated user who can create a new space, because the flawed cache key allows permission data from one space to leak into another, enabling privilege escalation. An attacker could gain admin rights in a victim space by first creating a space where they are granted admin and then switching spaces, thereby bypassing all group revocation mechanisms. The vulnerability’s high impact on confidentiality, integrity, and availability underscores the importance of applying the update promptly.