CVE-2026-35045 Details
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering. This vulnerability is fixed in 2.6.4.
A vulnerability in Tandoor Recipes prior to version 2.6.4 allows authenticated users within a Space to use the PUT /api/recipe/batch_update/ endpoint to modify any recipe, including those marked as private by other users. This issue arises because the batch update function bypasses object-level authorization checks, enabling the unauthorized exposure of private recipes, self-granting of access to shared recipes, and tampering with recipe metadata. The vulnerability is rooted in the Django REST Framework's handling of batch updates, which do not enforce the same permission checks as individual recipe updates.
Users can update to Tandoor Recipes version 2.6.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 | [email protected] | Release Notes |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-v8x3-w674-55p5 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tandoor recipes | < 2.6.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |