Tandoor Recipes Cross-Space IDOR Vulnerability in Sync Operations

A cross-space insecure direct object reference (IDOR) vulnerability has been identified in Tandoor Recipes versions prior to 2.6.0. The issue arises in the `SyncViewSet.query_synced_folder()` action, where a Sync object is retrieved without proper space filtering. This flaw allows an admin user in one space to access and manipulate sync operations and logs of another space.

Impact

Exploitation of this vulnerability allows an authenticated admin user to trigger sync operations on any space's Sync configuration, access sync logs from other spaces, and potentially import recipes into another space if the sync mechanism has write access.

Remediation

Users can upgrade to Tandoor Recipes version 2.6.0 or later to address this vulnerability.