CVE-2026-35488

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35488", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T20:49:44.454Z", "datePublished": "2026-04-07T14:51:25.861Z", "dateUpdated": "2026-04-08T14:48:54.946Z"}, "containers": {"cna": {"title": "Tandoor Recipes \u2014 CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users", "problemTypes": [{"descriptions": [{"cweId": "CWE-749", "lang": "en", "description": "CWE-749: Exposed Dangerous Method or Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f"}, {"name": "https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4"}], "affected": [{"vendor": "TandoorRecipes", "product": "recipes", "versions": [{"version": "< 2.6.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T14:51:25.861Z"}, "descriptions": [{"lang": "en", "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods \u2014 including DELETE, PUT, and PATCH \u2014 without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4."}], "source": {"advisory": "GHSA-xvmf-cfrq-4j8f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T14:48:32.807386Z", "id": "CVE-2026-35488", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:48:54.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35488", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:48:32.807386Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:48:46.370Z"}}], "cna": {"title": "Tandoor Recipes \u2014 CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users", "source": {"advisory": "GHSA-xvmf-cfrq-4j8f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "TandoorRecipes", "product": "recipes", "versions": [{"status": "affected", "version": "< 2.6.4"}]}], "references": [{"url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f", "name": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4", "name": "https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods \u2014 including DELETE, PUT, and PATCH \u2014 without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "CWE-749: Exposed Dangerous Method or Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T14:51:25.861Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35488", "state": "PUBLISHED", "dateUpdated": "2026-04-08T14:48:54.946Z", "dateReserved": "2026-04-02T20:49:44.454Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T14:51:25.861Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "recipes", "vendor": "TandoorRecipes", "versions": [{"status": "affected", "version": "< 2.6.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*", "matchCriteriaId": "D29C4837-2650-4BEF-A332-657E7D593877", "versionEndExcluding": "2.6.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods \u2014 including DELETE, PUT, and PATCH \u2014 without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4."}, {"lang": "es", "value": "Tandoor Recipes es una aplicaci\u00f3n para gestionar recetas, planificar comidas y crear listas de la compra. Anteriormente a la 2.6.4, RecipeBookViewSet y RecipeBookEntryViewSet usan CustomIsShared como una clase de permiso alternativa, pero CustomIsShared.has_object_permission() devuelve True para todos los m\u00e9todos HTTP - incluyendo DELETE, PUT y PATCH - sin comprobar request.method en SAFE_METHODS. Cualquier usuario que est\u00e9 en la lista compartida de un RecipeBook puede eliminarlo o sobrescribirlo, a pesar de que el acceso compartido es sem\u00e1nticamente de solo lectura. Esta vulnerabilidad se corrige en la versi\u00f3n 2.6.4."}], "id": "CVE-2026-35488", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35488", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T14:48:32.807386Z", "version": "2.0.3"}}]}, "published": "2026-04-07T16:16:27.003", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-749"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "recipes", "source": "cna", "vendor": "TandoorRecipes"}, "product": "recipes", "vendor": "tandoorrecipes"}], "analysis": {"en": {"generated_at": "2026-04-07T22:51:05.756686+00:00", "value": {"mitigation_remediation": ["Upgrade Tandoor Recipes to version 2.6.4 or later", "Verify that the RecipeBookEntryViewSet and RecipeBookViewSet use the corrected permission logic", "Monitor shared RecipeBook activity for unexpected deletions or updates", "Consult the vendor\u2019s release notes or security advisories for additional updates"], "summary": {"action": "Apply Patch", "impact": "Unauthorized data modification through privilege escalation"}, "threat_synthesis": {"affected_systems": "The issue affects the Tandoor Recipes application for the recipes product. All releases earlier than version 2.6.4 are vulnerable, including the corresponding RecipeBookViewSet and RecipeBookEntryViewSet. Production deployments of the recipes application running any pre\u20112.6.4 build are susceptible.", "description_and_impact": "The vulnerability exists in Tandoor Recipes, where the CustomIsShared permission component incorrectly grants all HTTP methods\u2014DELETE, PUT, and PATCH\u2014without verifying that the request is safe. Users who are listed as shared members of a RecipeBook, who are supposed to have read\u2011only access, can therefore delete or overwrite the entire book. This results in unauthorized data modification and effectively elevates a read\u2011only user to have full control over the targeted RecipeBook.", "risk_and_exploitability": "The CVSS score of 8.1 reflects a high severity of the defect, indicating significant impact if exploited. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits to date. The attack requires authenticated access as a user who has been granted shared read\u2011only rights; the attacker can then issue DELETE or PUT HTTP requests against the shared RecipeBook API endpoints. Because the flaw lies in the permission layer, exploitation is straightforward for anyone with shared access, making the vulnerability highly actionable for malicious insiders or compromised shared users."}}}}, "created": "2026-04-08T19:37:19.225046+00:00", "updated": "2026-04-08T19:48:37.091941+00:00", "vendors": ["tandoorrecipes", "tandoorrecipes$PRODUCT$recipes"]}