# CVE-2026-35488: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…

Source: https://junglewise.ai/threats/cve-2026-35488-tandoor-recipes-is-an-application-for-managing-recipes-planning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07  
License: CC BY 4.0 with a link back

CVE-2026-35488 · Severity: high · CVSS 8.1 · Published 2026-04-07

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.

Technologies: [Tandoor Recipes](https://junglewise.ai/threats/technologies/recipes). Vendors: [Tandoor](https://junglewise.ai/threats/vendors/tandoor).

## Quick answers

**Is CVE-2026-35488 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35488 being exploited in the wild.

**How severe is CVE-2026-35488?** High severity, with a CVSS score of 8.1, published 7 April 2026.

**Which products and versions are affected?** Tandoor Recipes. The advisory does not name versions.

**Is there a fix for CVE-2026-35488?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-35488?** Check whether you run Tandoor Recipes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Tandoor Recipes

## Related threats

- [Tandoor Recipes unauthorized access to other members' bookmarklets](https://junglewise.ai/threats/cve-2026-59967-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes Denial of Service via ZIP Bomb in recipe import](https://junglewise.ai/threats/cve-2026-27460-tandoor-recipes-denial-of-service-via-zip-bomb-in-recipe-import)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35489-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35046-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35045-tandoor-recipes-is-an-application-for-managing-recipes-planning)