CVE-2026-35489
HIGH EPSS 12.9%
Published Apr 7, 20262mo ago · Modified Jun 17, 20262w ago
7.3 CVSS 3.1
Published Apr 7, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability Low
Threat Intelligence
EPSS Exploit Probability
12.9% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 2
CWE-1284
CWE-639
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| tandoor | recipes | * | <2.6.4 |
References 2
- github.com https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4
- github.com https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.