The vulnerability exists in Tandoor Recipes, where the CustomIsShared permission component incorrectly grants all HTTP methods—DELETE, PUT, and PATCH—without verifying that the request is safe. Users who are listed as shared members of a RecipeBook, who are supposed to have read‑only access, can therefore delete or overwrite the entire book. This results in unauthorized data modification and effectively elevates a read‑only user to have full control over the targeted RecipeBook.

The issue affects the Tandoor Recipes application for the recipes product. All releases earlier than version 2.6.4 are vulnerable, including the corresponding RecipeBookViewSet and RecipeBookEntryViewSet. Production deployments of the recipes application running any pre‑2.6.4 build are susceptible.

The CVSS score of 8.1 reflects a high severity of the defect, indicating significant impact if exploited. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits to date. The attack requires authenticated access as a user who has been granted shared read‑only rights; the attacker can then issue DELETE or PUT HTTP requests against the shared RecipeBook API endpoints. Because the flaw lies in the permission layer, exploitation is straightforward for anyone with shared access, making the vulnerability highly actionable for malicious insiders or compromised shared users.