Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35489 Information Disclosure and Unvalidated Input in Tandoor Recipes Before 2.6.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35489
Post summary
The post announces CVE-2026-35489, indicating it is an information disclosure caused by unvalidated input in Tandoor Recipes versions prior to 2.6.4, and links to a detail page.
CVE-2026-35489 Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads … https://www.cve.org/CVERecord?id=CVE-2026-35489
Post summary
The text merely references CVE-2026-35489 and gives a cursory note about an endpoint; no concrete details about exploitation, patching, or active use are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tandoor | recipes | - | - | - |