PT-2026-30862 · Unknown · Tandoor Recipes

Filipegaudard · CVE-2026-35489 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.4

Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The POST /api/food/{id}/shopping/ endpoint reads the amount and unit directly from request data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields.

Recommendations Update to version 2.6.4 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-1284

Related Identifiers

CVE-2026-35489

GHSA-8W8H-3PV2-3554

Affected Products

Tandoor Recipes

References · 7

• 🔥 https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35489.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-35489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35489 · Security Note
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 · Note
• https://twitter.com/VulmonFeeds/status/2041617007703990549 · Twitter Post
• https://twitter.com/CVEnew/status/2041603225216864576 · Twitter Post