CVE-2026-35488: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…
CVE-2026-35488 · Severity: high · CVSS 8.1 · Published 2026-04-07
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.
No. Junglewise Threat Intelligence has no report of CVE-2026-35488 being exploited in the wild.
How severe is CVE-2026-35488?
High severity, with a CVSS score of 8.1, published 7 April 2026.
Which products and versions are affected?
Tandoor Recipes. The advisory does not name versions.
Is there a fix for CVE-2026-35488?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-35488?
Check whether you run Tandoor Recipes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.