CVE-2026-35488 - Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users

Back Back to CVE browser

HIGH

Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users

Published Apr 7, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.50%

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.

Affected products

Vendor TandoorRecipes Product Recipes Default
n/a
- Version
  < 2.6.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TandoorRecipes

Recipes

n/a

Version	Status	Constraints
< 2.6.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-749

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19673
Advisory
https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4
x_refsource_MISCProductRelease Notes
https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f
x_refsource_CONFIRMExploitMitigationVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19673		Advisory
https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4		x_refsource_MISCProductRelease Notes
https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f		x_refsource_CONFIRMExploitMitigationVendor Advisory