CVE-2026-35045: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…
CVE-2026-35045 · Severity: high · CVSS 8.1 · Published 2026-04-06
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering. This vulnerability is fixed in 2.6.4.
No. Junglewise Threat Intelligence has no report of CVE-2026-35045 being exploited in the wild.
How severe is CVE-2026-35045?
High severity, with a CVSS score of 8.1, published 6 April 2026.
Which products and versions are affected?
Tandoor Recipes. The advisory does not name versions.
Is there a fix for CVE-2026-35045?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-35045?
Check whether you run Tandoor Recipes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.