Tandoor Recipes Flaw Exposes Private Recipes
CVE Notify is flagging a critical authorization bypass vulnerability in Tandoor Recipes, an application used for managing recipes, meal planning, and shopping lists. The issue, tracked as CVE-2026-35045, impacts versions prior to 2.6.4. According to CVE Notify, the PUT /api/recipe/batch_update/ endpoint allows any authenticated user within a shared ‘Space’ to modify any recipe, irrespective of its privacy settings. This effectively bypasses the object-level authorization checks that are supposed to protect individual recipes.
The implications are significant. CVE Notify highlights that this flaw enables unauthorized users to expose private recipes, grant themselves access to recipes through the shared list functionality, and even tamper with recipe metadata. This is a serious lapse in access control, turning a personal recipe manager into a potential privacy nightmare for users.
Fortunately, this vulnerability has been patched. Tandoor Recipes version 2.6.4 addresses CVE-2026-35045, closing the door on these unauthorized access and modification capabilities. Users are strongly advised to update to the latest version immediately to secure their recipe data.
What This Means For You
- Ensure that all API endpoints enforcing authorization checks, especially those handling batch operations or updates, are rigorously tested for bypass vulnerabilities. Don't assume that individual object-level checks are sufficient; verify that broader collection-level operations also respect access controls.
Related ATT&CK Techniques
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-35045 | Auth Bypass | Tandoor Recipes prior to 2.6.4, PUT /api/recipe/batch_update/ endpoint, allows authenticated users to modify any recipe in a Space, including private recipes. |
| CVE-2026-35045 | Information Disclosure | Tandoor Recipes prior to 2.6.4, PUT /api/recipe/batch_update/ endpoint, enables forced exposure of private recipes. |
| CVE-2026-35045 | Misconfiguration | Tandoor Recipes prior to 2.6.4, PUT /api/recipe/batch_update/ endpoint, bypasses object-level authorization checks. |