CVE-2026-35045

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35045
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35045.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35045
Aliases
  • GHSA-v8x3-w674-55p5
Published
2026-04-06T17:17:57.647Z
Modified
2026-07-15T01:49:02.523201022Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification
Details

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering. This vulnerability is fixed in 2.6.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35045.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/tandoorrecipes/recipes

Affected ranges

Type
GIT
Repo
https://github.com/tandoorrecipes/recipes
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0320f99b7e6c72f2325a5132e72f791b0e911b6d
Database specific 
{
    "cpe": "cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.4"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.12.0
0.12.1
0.13.0
0.15.0
0.15.1
0.15.2
0.16.0
0.17.1
0.17.2
0.17.3
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.1
0.9.0
0.9.1
0.9.2
1.*
1.0.3
1.1.3
1.1.4
1.2.4
1.2.5
1.5.11
2.*
2.0.0-alpha-1
2.0.0-alpha-2
2.0.0-alpha-3
2.0.0-alpha-4
2.0.0-alpha-5
2.0.0-alpha-6
2.2.7
2.3.0
2.3.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35045.json"