A flaw in the Tandoor Recipes application allows an authenticated member of a shared space to supply another member's private recipe identifier to various API endpoints without triggering the proper authorization checks. As a result, private recipe files or links may be read, sent to external AI providers, or exposed via public share‑links. The weakness is an authorization bypass (CWE‑639) that could lead to disclosure of confidential user data. The impact is the unintended exposure of private recipe content to other users in the same space and to external services potentially receiving the data via AI import or file sharing.

The vulnerability affects the TandoorRecipes:recipes project prior to version 2.6.10. Installing 2.6.10 or newer fixes the issue by enforcing proper object‑level permission checks on recipe utility endpoints.

The CVSS score of 7.1 indicates a high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user in a shared space interacting with the vulnerable API endpoints; this requires no special expertise beyond normal application usage. Attackers could gain unauthorized access to private recipe files and potentially expose them to external services.