PatchTheCEVCVE-2026-35045: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists
41
This month
HIGH 8.1UPGRADE
CVE-2026-35045 is a high-severity flaw (CVSS 8.1) affecting recipes. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 69%) |
| CISA exploited list | No |
| Weakness | CWE-639 |
| Published | 2026-04-06 |
| Last modified | 2026-10-23 |
Publisher (CNA): GitHub, Inc. · Vendor: tandoor
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
tandoor recipes UPGRADE
Affected: < 2.6.4
Fixed in: 2.6.4
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy recipes || rpm -q recipes || recipes --version
2. UPGRADE to 2.6.4 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade recipes
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade recipes
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.