Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-35489Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`

High 7.3

In plain English

A high-severity authorization bypass via user-controlled key in recipes from TandoorRecipes. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.2%top 85.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.

Affected products (as reported)

Vendor	Product	Versions
TandoorRecipes	recipes	< 2.6.4

Weakness: CWE-639, CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 x_refsource_CONFIRM
https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 x_refsource_MISC