CVE-2026-35489 Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`

High 7.3 Published 7 Apr 2026 Updated 7 Apr 2026

Attackers can bypass validation to leak cross-tenant data or cause denial of service in Tandoor Recipes shopping list endpoints.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-35489?

CVE-2026-35489 is a high-severity missing authorization vulnerability in TandoorRecipes recipes, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.

Weakness: CWE-639, CWE-1284

Which versions are affected by CVE-2026-35489?

It affects 1 product.

Products include Tandoor Recipes.

How do I fix CVE-2026-35489?

No fix has been published for CVE-2026-35489 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-35489 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35489 exists.

Sources

Also known as GHSA-8w8h-3pv2-3554.