# CVE-2026-35489: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…

Source: https://junglewise.ai/threats/cve-2026-35489-tandoor-recipes-is-an-application-for-managing-recipes-planning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07  
License: CC BY 4.0 with a link back

CVE-2026-35489 · Severity: high · CVSS 7.3 · Published 2026-04-07

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.

Technologies: [Tandoor Recipes](https://junglewise.ai/threats/technologies/recipes). Vendors: [Tandoor](https://junglewise.ai/threats/vendors/tandoor).

## Quick answers

**Is CVE-2026-35489 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35489 being exploited in the wild.

**How severe is CVE-2026-35489?** High severity, with a CVSS score of 7.3, published 7 April 2026.

**Which products and versions are affected?** Tandoor Recipes. The advisory does not name versions.

**Is there a fix for CVE-2026-35489?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-35489?** Check whether you run Tandoor Recipes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Tandoor Recipes

## Related threats

- [Tandoor Recipes unauthorized access to other members' bookmarklets](https://junglewise.ai/threats/cve-2026-59967-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes Denial of Service via ZIP Bomb in recipe import](https://junglewise.ai/threats/cve-2026-27460-tandoor-recipes-denial-of-service-via-zip-bomb-in-recipe-import)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35488-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35046-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35045-tandoor-recipes-is-an-application-for-managing-recipes-planning)