Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 Exploit, Mitigation, Vendor Advisory
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.3 · tandoorNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*
References 3
- https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4 Product, Release Notes
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 Exploit, Mitigation, Vendor Advisory
- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 Exploit, Mitigation, Vendor Advisory