Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-35045. PoCs published by adminlove520, FilipeGaudard.
AI-analyzed exploit summary The repository contains a functional exploit PoC for CVE-2026-35045, demonstrating a Broken Object-Level Authorization vulnerability in Tandoor Recipes. The PoC includes a Python script that exploits the `PUT /api/recipe/batch_update/` endpoint to bypass authorization checks and modify private recipes owned by other users.
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering. This vulnerability is fixed in 2.6.4.
Exploits (2)
The repository contains a functional exploit PoC for CVE-2026-35045, demonstrating a Broken Object-Level Authorization vulnerability in Tandoor Recipes. The PoC includes a Python script that exploits the `PUT /api/recipe/batch_update/` endpoint to bypass authorization checks and modify private recipes owned by other users.
The repository contains a functional exploit PoC for CVE-2026-35045, demonstrating a Broken Object-Level Authorization vulnerability in Tandoor Recipes. The exploit leverages a Django REST Framework behavioral gap in the `batch_update` endpoint to bypass object-level permission checks, allowing any authenticated user within a Space to modify any recipe, including private recipes owned by other users.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N