PT-2026-30861 · Unknown · Tandoor Recipes

Filipegaudard · CVE-2026-35488 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.4

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as a permission class. The CustomIsShared.has object permission() function incorrectly returns True for all HTTP methods (DELETE, PUT, and PATCH) without verifying if the request method is within the list of safe methods (SAFE METHODS). This allows any user in a RecipeBook's shared list to delete or modify it, despite shared access being intended as read-only.

Recommendations Update to version 2.6.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-749

Related Identifiers

CVE-2026-35488

GHSA-XVMF-CFRQ-4J8F

Affected Products

Tandoor Recipes

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35488.json · Exploit
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35488 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35488 · Vendor Advisory
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 · Note
• https://twitter.com/VulmonFeeds/status/2041619567747776610 · Twitter Post
• https://twitter.com/CVEnew/status/2041603226194071733 · Twitter Post