CVE-2026-35045 - Vulnerability Analysis

Overview

Tandoor Recipes < 2.6.4 contains a broken access control vulnerability caused by insufficient authorization checks in the PUT /api/recipe/batch_update/ endpoint, letting authenticated users modify any recipe in a Space, including private ones, exploit requires user authentication within the Space.

Severity & Score

Impact

Authenticated users can modify private recipes of others, exposing sensitive data and tampering with metadata.

Mitigation

Upgrade to version 2.6.4 or later.

References

• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-v8x3-w674-55p5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner