Recipes CVE-2026-35489

Remote unauthenticated attacker can exploit Tandoor Recipes versions prior to 2.6.4 by sending crafted POST requests to /api/food/{id}/shopping/ endpoint with cross-Space unit IDs to leak foreign-key references across tenant boundaries or trigger HTTP 500 errors with invalid amount values.

Real-world risk is moderate-high for multi-tenant Tandoor deployments, though lower for single-user instances. The CVSS 7.3 score (AV:N/AC:L/PR:N/UI:N) correctly identifies network accessibility and low exploitation complexity with no authentication required, yielding partial impact across confidentiality, integrity, and availability. The confidentiality impact stems from cross-tenant unit ID leakage, which could expose organizational structure or recipe metadata from other tenants. Integrity impact involves polluting shopping lists with invalid data or foreign unit references. Availability impact is immediate via trivial denial-of-service by sending malformed amount values to crash request handlers. However, practical exploitation requires knowledge of valid food IDs and the API structure, limiting fully automated mass exploitation. No EPSS score is available, but the combination of unauthenticated access, low complexity, and publicly documented remediation in GitHub advisories suggests moderate exploitation likelihood once details are widely known. No public exploit code exists and the vulnerability is not on CISA KEV, indicating no confirmed active exploitation. SSVC factors: exploitation is possible (technical details public), automatable (API-based, repeatable), and technical impact is moderate (limited to application-layer DoS and metadata leakage, not system compromise). Priority should be high for SaaS/multi-tenant deployments, medium for self-hosted single-tenant instances.

An unauthenticated attacker identifies a public-facing Tandoor Recipes instance (version <2.6.4) and enumerates valid food object IDs through trial-and-error or by scraping publicly accessible recipe pages. The attacker sends crafted POST requests to /api/food/{valid_id}/shopping/ with amount set to a non-numeric string (e.g., 'XXX'), causing repeated HTTP 500 errors and degrading service availability for legitimate users. In a multi-tenant scenario, the attacker further sends requests with unit IDs incrementally iterated across a range, successfully associating unit objects from Tenant A's Space with shopping list entries nominally scoped to Tenant B, thereby leaking foreign-key relationships and potentially exposing organizational recipe structures or ingredient taxonomies across tenant boundaries. No public exploit code exists, but exploitation requires only basic HTTP client tools and knowledge of REST API conventions.