EUVD-2026-19674Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
6DescriptionGitHub Advisory
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.
AnalysisAI
Unauthenticated API input validation flaws in Tandoor Recipes (<2.6.4) enable cross-tenant data leakage and denial of service. The /api/food/{id}/shopping/ endpoint accepts unvalidated amount and unit parameters, allowing attackers to cause application crashes via malformed numeric inputs (HTTP 500 errors) and leak foreign-key references across multi-tenant Space boundaries by associating unit IDs from other tenants. CVSS 7.3 reflects network-accessible, low-complexity attacks requiring no authentication. No public exploit identified at time of analysis, though exploitation is straightforward via direct API calls. EPSS data not available. Vendor-released patch: version 2.6.4.
Technical ContextAI
Tandoor Recipes is a Django-based web application for recipe management with multi-tenant architecture using Space-based isolation. The vulnerability exists in a POST endpoint at /api/food/{id}/shopping/ that bypasses the application's standard ShoppingListEntrySerializer validation layer. Instead of using the serializer's field validation, the endpoint directly reads amount (expected numeric) and unit (foreign key to Unit model) from request.data and passes them to Django ORM's ShoppingListEntry.objects.create() without sanitization. This creates two distinct issues: (1) Type confusion when non-numeric strings are passed as amount values, causing Python/Django exceptions that propagate as HTTP 500 errors; (2) Missing tenant isolation checks on the unit foreign key, allowing an attacker to reference Unit objects from different Space contexts, violating the multi-tenant boundary and exposing cross-tenant foreign-key relationships. The root cause maps to CWE-639 (Authorization Bypass Through User-Controlled Key), where user-supplied foreign keys are not validated against authorization context. All other ShoppingListEntry creation endpoints properly use ShoppingListEntrySerializer, which includes field-level validation and tenant boundary enforcement, making this an isolated architectural inconsistency.
RemediationAI
Upgrade to Tandoor Recipes version 2.6.4 or later, which implements proper input validation by routing the vulnerable endpoint through ShoppingListEntrySerializer to enforce field-type validation and tenant boundary checks. The fix is available in the official release at https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4. For environments where immediate upgrade is not feasible, implement network-level access controls to restrict API endpoint access to authenticated users only, though this is a mitigation rather than a complete fix as it does not address the cross-tenant data leakage for authenticated users in multi-tenant deployments. Review application logs for HTTP 500 errors on the /api/food/*/shopping/ endpoint and unexpected ShoppingListEntry records with cross-Space unit references to identify potential exploitation attempts. No temporary code-level workaround is documented; the architectural fix in 2.6.4 is the definitive remediation.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Tandoor Recipes prior to 2.5.1 contains a blind server-side request forgery vulnerability in the Cookmate recipe import
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. Rated medium severity (CVS
Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. Rated medium severity (CVSS 6.5), t
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” fu
Path traversal in Tandoor Recipes prior to 2.5.1 allows authenticated users with import permissions to read arbitrary fi
Privilege escalation in Tandoor Recipes prior to version 2.6.4 allows authenticated users with read-only shared access t
Authenticated users can modify and expose private recipes in Tandoor Recipes through broken object-level authorization i
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Ke
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard funct
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functiona
Tandoor Recipes versions prior to 2.6.0 allow authenticated remote attackers to cause denial of service by injecting URL
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today