The flaw is an insecure object lookup in the SyncViewSet.query_synced_folder method. An admin user can request a sync for any Sync object without the system verifying that the sync belongs to the user’s current space. This allows the user to trigger imports from external providers in another space and read the corresponding sync logs, potentially exposing sensitive data. The weakness is a permission assumption error, identified as CWE-639.

The vulnerability affects the Tandoor Recipes application, versions older than 2.6.0. Any installation running 2.5.x or earlier is susceptible; the issue resides in cookbook/views/api.py. The affected vendor is TandoorRecipes:recipes.

The CVSS score of 5.5 indicates moderate severity, while the EPSS less than 1% suggests low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated admin in one space to execute a sync operation that targets a Sync object in a different space, exposing control over external import processes and the resulting logs.