CVE-2026-35045
Published: 06 April 2026
Summary
CVE-2026-35045 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Tandoor Recipes. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-16 (Security and Privacy Attributes).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates enforcement of approved authorizations for object-level access to recipes, preventing the batch_update endpoint from bypassing checks on private recipes owned by other users.
Enforces least privilege by restricting Space users to only their own or explicitly permitted recipes, mitigating unauthorized modifications via the vulnerable batch endpoint.
Requires security attributes such as 'private' status to be associated with recipes and enforced across all endpoints, including batch updates, to block unauthorized access and tampering.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass in public-facing web app directly enables T1190 exploitation, resulting in privilege escalation (T1068), unauthorized collection from information repositories (T1213), and stored data manipulation (T1565).
NVD Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes…
more
marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering. This vulnerability is fixed in 2.6.4.
Deeper analysisAI
CVE-2026-35045 is an authorization bypass vulnerability in Tandoor Recipes, a self-hosted web application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint fails to enforce proper object-level access controls, allowing any authenticated user within a shared Space to modify recipes owned by other users, including those explicitly marked as private. This circumvents the authorization checks present in standard single-recipe endpoints like PUT /api/recipe/{id}/, and is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impacts.
An attacker requires only low-privilege authentication as a user within the target Space to exploit this issue remotely over the network with no user interaction. Successful exploitation enables reading and modifying private recipes, injecting or altering content to force exposure, self-granting access through manipulation of shared lists, and tampering with recipe metadata. These actions could lead to unauthorized data disclosure, recipe corruption, or privilege escalation within the Space, potentially compromising the confidentiality and integrity of user-managed content across the application.
The vulnerability is addressed in Tandoor Recipes version 2.6.4, as detailed in the project's release notes and security advisory. Security practitioners should upgrade to 2.6.4 or later, review access controls in multi-user Spaces, and audit batch update endpoints for similar bypasses in custom deployments. Relevant resources include the GitHub release at https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 and the advisory at https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-v8x3-w674-55p5.
Details
- CWE(s)