Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.
References
| Link | Resource |
|---|---|
| https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 | Product Release Notes |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 | Exploit Mitigation Vendor Advisory |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 | Exploit Mitigation Vendor Advisory |
Configurations
History
14 Apr 2026, 20:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 - Product, Release Notes | |
| References | () https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 - Exploit, Mitigation, Vendor Advisory | |
| CPE | cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:* | |
| First Time |
Tandoor
Tandoor recipes |
07 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 - |
07 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-07 16:16
Updated : 2026-04-14 20:13
NVD link : CVE-2026-35489
Mitre link : CVE-2026-35489
CVE.ORG link : CVE-2026-35489
JSON object : View
Products Affected
tandoor
- recipes