PT-2026-30861 · Tandoorrecipes · Recipes

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-35488

Mitre

CVSS v3.1

8.1

High

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has object permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.

Fix

Weakness Enumeration

CWE-749

Related Identifiers

CVE-2026-35488

Affected Products

Recipes

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-35488 · Security Note
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 · Note
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f · Note