CVE-2026-35489: Tandoor Recipes

High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.

Affected products

• Tandoor Recipes: before 2.6.4 (fixed in 2.6.4)

Published 2026-04-07. Last modified 2026-06-17.