Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification

Tandoor Recipes allows any logged-in user in a workspace to modify and expose other users' private recipes through a batch update endpoint. This bypasses security checks that normally protect individual recipes, letting attackers force recipes to be shared or change their details without permission.

The PUT /api/recipe/batch_update/ endpoint lacks object-level authorization validation present in single-recipe endpoints, allowing authenticated users to modify arbitrary recipes within their Space including private recipes owned by others. Attack vector is direct API manipulation; pre-condition is user authentication within a Space; impact includes unauthorized recipe exposure, forced sharing via shared lists, and metadata tampering. Fixed in version 2.6.4.