Threats affecting pkg:github/Tandoor Recipes

CVE-2026-112342 is a high-severity vulnerability in Tandoor Recipes before version 2.7.0. It involves improper authorization due to a flawed cache-key design that causes stale group-based permissions to persist across different spaces. Authenticated users can exploit this by creating a space where they have admin privileges, then switching to a victim space with lower privileges, thereby gaining unauthorized elevated access. This bypasses group revocations or demotions across multiple permission classes and views. The issue is fixed in version 2.7.0.