The flaw in Tandoor Recipes permits an authenticated user who belongs to the same Space but does not own a private recipe to read and silently modify the steps of that recipe via the /api/step/ endpoints. The vulnerability arises because the StepViewSet and IngredientViewSet filter only by the active Space and perform a generic CustomIsUser check instead of validating the private‑recipe owner. This enables the attacker to access and alter instructions that should be restricted to the recipe creator, thereby breaching confidentiality and integrity and constituting a privilege‑escalation/authorization bypass.

The vulnerability affects the Tandoor Recipes application in any release earlier than 2.6.12. All instances where users have been granted read and write API scopes in a shared Space are potentially impacted. The flaw does not allow cross‑Space access—only members of the same Space can exploit it.

With a CVSS score of 8.1 the issue is high severity. No EPSS data is available and the vulnerability is not listed in CISA KEV, indicating that a public exploit is not yet known, but the attack requires only normal authenticated API use. Because an attacker can read or silently change private recipe content, the risk to confidentiality and integrity of user data is significant.