CVE-2026-35489

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.

• CWE-639
• CWE-1284

• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4Product, Release Notes
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554Exploit, Mitigation, Vendor Advisory
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554Exploit, Mitigation, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35483text-generation-webui is an open-source web interface for ru…5.3
• CVE-2026-35484text-generation-webui is an open-source web interface for ru…5.3
• CVE-2026-35485text-generation-webui is an open-source web interface for ru…7.5
• CVE-2026-35486text-generation-webui is an open-source web interface for ru…7.5
• CVE-2026-35487text-generation-webui is an open-source web interface for ru…5.3
• CVE-2026-35488Tandoor Recipes is an application for managing recipes, plan…8.1
• CVE-2026-3549Heap Overflow in TLS 1.3 ECH parsing. An integer underflow e…9.8
• CVE-2026-35490changedetection.io is a free open source web page change det…9.8
• CVE-2026-35491FTLDNS (pihole-FTL) provides an interactive API and also gen…6.1
• CVE-2026-35492Kedro-Datasets is a Kendo plugin providing data connectors. …6.5
• CVE-2026-35496A path traversal vulnerability exists in CubeCart prior to 6…5.1
• CVE-2026-3550The RockPress plugin for WordPress is vulnerable to Missing …5.3