PT-2026-30684 · Unknown · Tandoor Recipes

Filipegaudard · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35045

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.4

Description The Tandoor Recipes application, used for managing recipes, meal planning, and shopping lists, has an issue where the PUT /api/recipe/batch update/ endpoint allows authenticated users within a Space to modify any recipe in that Space, even those marked as private by other users. This circumvents object-level authorization checks, potentially leading to the forced exposure of private recipes, unauthorized access via shared lists, and metadata tampering.

Recommendations Update to version 2.6.4 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-35045

Affected Products

Tandoor Recipes

References · 4

• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-v8x3-w674-55p5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35045 · Security Note
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 · Note
• https://twitter.com/CVEnew/status/2041223959358624208 · Twitter Post