CVE-2026-35045: Tandoor Recipes Auth Bypass Vulnerability

CVE-2026-35045 Overview

CVE-2026-35045 is an authorization bypass vulnerability in Tandoor Recipes, an application for managing recipes, planning meals, and building shopping lists. Prior to version 2.6.4, the PUT /api/recipe/batch_update/ endpoint allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering.

Critical Impact

Authenticated attackers can bypass authorization controls to access and modify private recipes belonging to other users, potentially exposing sensitive personal data and undermining data integrity within shared Spaces.

Affected Products

• Tandoor Recipes versions prior to 2.6.4

Discovery Timeline

• 2026-04-06 - CVE-2026-35045 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35045

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), also known as Insecure Direct Object Reference (IDOR). The flaw exists in the batch update endpoint's authorization logic, which fails to verify that the requesting user has appropriate permissions for each recipe included in a batch operation.

While the standard single-recipe update endpoint (PUT /api/recipe/{id}/) properly enforces object-level authorization checks to verify the requesting user owns or has explicit access to the recipe, the batch update endpoint (PUT /api/recipe/batch_update/) does not implement equivalent authorization controls. This disparity creates an exploitable gap where attackers can craft batch update requests containing recipe IDs they should not be able to modify.

The impact of successful exploitation includes unauthorized access to private recipe content, the ability to modify recipe metadata and sharing permissions, and potential data integrity violations across the application.

Root Cause

The root cause stems from inconsistent authorization enforcement between the batch update endpoint and standard single-recipe endpoints. The batch update functionality was implemented without replicating the object-level permission checks that protect individual recipe operations. When processing batch requests, the application verifies only that the user is authenticated and belongs to the target Space, but fails to validate per-recipe ownership or sharing permissions.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user with access to a Space. An attacker can enumerate recipe IDs within their Space and submit batch update requests to modify recipes they do not own. By manipulating the shared list parameter, an attacker can grant themselves access to private recipes or alter recipe visibility settings to expose other users' private content.

The attack requires low complexity with no user interaction needed. An authenticated attacker simply needs to craft a malicious PUT request to the /api/recipe/batch_update/ endpoint containing the target recipe IDs and desired modifications. Since the endpoint processes all submitted recipe IDs without per-object authorization checks, the modifications are applied regardless of the attacker's actual permissions.

For technical details on the exploitation mechanism, refer to the GitHub Security Advisory GHSA-v8x3-w674-55p5.

Detection Methods for CVE-2026-35045

Indicators of Compromise

• Unusual volume of requests to the /api/recipe/batch_update/ endpoint from a single user
• Batch update operations targeting recipe IDs not owned by the requesting user
• Unexpected changes to recipe sharing permissions or privacy settings
• Audit log entries showing recipes being modified by users other than their owners

Detection Strategies

• Implement application-level logging for all batch update operations including the requesting user and target recipe IDs
• Monitor for discrepancies between recipe ownership and modification events in application logs
• Deploy Web Application Firewall (WAF) rules to flag unusual batch update patterns
• Enable detailed API request logging to capture full request bodies for forensic analysis

Monitoring Recommendations

• Review audit logs for unauthorized recipe modifications, particularly changes to sharing and visibility settings
• Set up alerts for batch update operations affecting multiple recipes owned by different users
• Monitor for authenticated users accessing or modifying recipes outside their normal usage patterns
• Implement rate limiting on the batch update endpoint to reduce potential abuse velocity

How to Mitigate CVE-2026-35045

Immediate Actions Required

• Upgrade Tandoor Recipes to version 2.6.4 or later immediately
• Review application logs for any signs of unauthorized recipe modifications prior to patching
• Audit recipe sharing permissions to identify any unauthorized access grants
• Notify users within affected Spaces to review their private recipe visibility settings

Patch Information

The vulnerability has been fixed in Tandoor Recipes version 2.6.4. The patch implements proper object-level authorization checks on the batch update endpoint to ensure users can only modify recipes they own or have explicit permission to edit. For detailed release information, see the GitHub Release Notes 2.6.4.

Organizations should prioritize this upgrade as the vulnerability allows authenticated attackers to bypass access controls and compromise user data integrity.

Workarounds

• Restrict access to the batch update API endpoint at the network or reverse proxy level until patching is complete
• Implement additional authorization checks at the web application firewall layer for requests to /api/recipe/batch_update/
• Temporarily disable the batch update functionality if operationally feasible
• Limit Space membership to trusted users until the patch can be deployed

For additional security guidance, refer to the GitHub Security Advisory GHSA-v8x3-w674-55p5.