theinfosecnews
theinfosecnews
Subscribe to Daily Digest

CVE-2026-35488

Published April 7, 2026 · Updated April 7, 2026

8.1CVSS
high

What This Means

CVE-2026-35488 is a high-severity vulnerability in Tandoor Recipes prior to version 2.6.4. The issue arises from the CustomIsShared permission class, which grants all users in a shared recipe list the ability to perform DELETE, PUT, and PATCH operations without proper checks, allowing unauthorized modifications to shared recipes. Upgrade to Tandoor Recipes version 2.6.4 or later to mitigate this risk.

Official Description+

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.

Recommended Actions

  1. Check if your systems use any of the affected products listed above.
  2. Apply vendor patches immediately if available.
  3. Monitor vendor advisories for updates and additional mitigations.
  4. Review logs for indicators of compromise related to CVE-2026-35488.

Related Coverage