Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35488 Unauthorized Modification Vulnerability in Tandoor Recipes Before 2.6.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35488
Post summary
The brief notice identifies CVE-2026-35488 as an unauthorized modification vulnerability affecting Tandoor Recipes prior to version 2.6.4, but provides no additional detail beyond the summary title and a reference link.
CVE-2026-35488 Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use … https://www.cve.org/CVERecord?id=CVE-2026-35488
Post summary
The text merely references CVE‑2026‑35488 in Tandoor Recipes, noting that before version 2.6.4 certain ViewSets are used, without providing further vulnerability, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tandoor | recipes | - | - | - |