CVE-2026-35488: Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.hasobjectpermission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFEMETHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35488?
CVE-2026-35488 has been classified with a medium severity due to improper access control that allows shared users to perform DELETE/PUT operations.
How do I fix CVE-2026-35488?
To mitigate CVE-2026-35488, update Tandoor Recipes to version 2.6.4 or later.
Who is affected by CVE-2026-35488?
Users of Tandoor Recipes prior to version 2.6.4 are the ones affected by CVE-2026-35488.
What types of actions are enabled due to CVE-2026-35488?
CVE-2026-35488 allows shared (read-only) users to perform DELETE and PUT actions on the RecipeBook.
What is Tandoor Recipes?
Tandoor Recipes is an application designed for managing recipes, meal planning, and creating shopping lists.