CVE-2026-35488

The record

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.

Affected packages

Related vulnerabilities

• CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation… CWE-749
• CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron… CWE-749
• CVE-2026-52877 Streambert is a cross-platform Electron Desktop App to stream and download video content. CWE-749
• CVE-2026-48056 Streambert is a cross-platform Electron Desktop App to stream and download video content. CWE-749
• CVE-2026-20467 In apusys, there is a possible escalation of privilege due to a missing bounds check. CWE-749
• CVE-2026-45489 Microsoft Edge (Chromium-based) Spoofing Vulnerability CWE-749
• CVE-2026-14620 webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints… CWE-749
• CVE-2026-54753 Nx is a monorepo solution for TypeScript and polyglot codebases. CWE-749