Tandoor Recipes, an application for managing recipes and meal planning, contains an authorization bypass vulnerability (CWE-639) in the PUT /api/recipe/batch_update/ endpoint in versions before 2.6.4. Unlike the single-recipe update endpoint which enforces object-level authorization, the batch update endpoint allows any authenticated user within the same Space to modify any recipe, including private ones belonging to other users. This flaw permits unauthorized exposure of private recipes, unauthorized self-granting of access via shared lists, and tampering with recipe metadata. The issue is resolved in version 2.6.4.

Exploitation of this vulnerability allows an authenticated user with access to a Space to bypass authorization controls and modify any recipe within that Space, including private recipes of other users. This can lead to unauthorized disclosure of private recipe data, unauthorized access escalation via shared lists, and integrity violations through metadata tampering. There is no indication of availability impact. The CVSS 3.1 base score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality and integrity impacts.

This vulnerability is fixed in Tandoor Recipes version 2.6.4. Users should upgrade to version 2.6.4 or later to remediate this issue. Since this is not a cloud service, patching the application instance is required. Patch status is confirmed by the vendor advisory stating the fix is included in version 2.6.4. No additional mitigation steps are indicated.