CVE-2026-35489
Input Validation Flaw in Tandoor Recipes Causes Data Leak
Publication date: 2026-04-07
Last updated on: 2026-04-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tandoor | recipes | to 2.6.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Tandoor Recipes affects the POST /api/food/{id}/shopping/ endpoint in versions prior to 2.6.4. This endpoint reads the 'amount' and 'unit' fields directly from the request data without proper validation or sanitization before creating a ShoppingListEntry.
- The 'amount' field is expected to be numeric, but non-numeric strings cause an unhandled exception leading to an HTTP 500 Internal Server Error.
- The 'unit' field is a foreign key that should be limited to the current tenant's space, but the endpoint does not enforce this, allowing cross-tenant foreign key references and data leakage.
Other endpoints use proper serializers that validate and sanitize these fields, but this specific endpoint lacks such protections. The issue was fixed in version 2.6.4.
How can this vulnerability impact me? :
This vulnerability can impact you in several ways:
- Server Stability: Sending invalid non-numeric 'amount' values can cause unhandled exceptions and HTTP 500 errors, potentially crashing the server or exposing internal details in debug mode.
- Data Confidentiality: The lack of validation on the 'unit' foreign key allows associating shopping list entries with units from other tenants' spaces, leading to unauthorized cross-tenant data leakage.
- Data Integrity: Unauthorized foreign key associations can corrupt data integrity by mixing data across tenant boundaries.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the POST /api/food/{id}/shopping/ endpoint with invalid input values to observe improper handling.
- Send a POST request with a non-numeric string in the amount field (e.g., amount="not_a_number") and check if the server responds with an HTTP 500 Internal Server Error.
- Send a POST request with a unit ID that belongs to a different tenant's space and verify if the request succeeds, indicating cross-tenant foreign key leakage.
Example curl command to test amount validation:
- curl -X POST https://your-tandoor-instance/api/food/123/shopping/ -H "Content-Type: application/json" -d '{"amount": "not_a_number", "unit": 1}'
Example curl command to test unit cross-space leakage:
- curl -X POST https://your-tandoor-instance/api/food/123/shopping/ -H "Content-Type: application/json" -d '{"amount": "1", "unit": 999}'
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows cross-tenant data leakage by associating a ShoppingListEntry with a unit from another tenant's space, which can lead to unauthorized access to foreign-key references across tenant boundaries.
Such unauthorized data exposure and cross-tenant data leakage can negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict data segregation and protection of personal and sensitive information.
Additionally, the unhandled exceptions causing HTTP 500 errors may expose internal server details in debug mode, potentially leaking sensitive information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include validating and sanitizing input data on the vulnerable endpoint.
- Validate the amount field by converting it to a Decimal and handle exceptions to return a 400 Bad Request on invalid input.
- Filter the unit foreign key by the current tenant's space and return a 400 error if the unit does not belong to the current space.
- Refactor the POST /api/food/{id}/shopping/ endpoint to reuse the ShoppingListEntrySerializer, which properly validates and sanitizes input.
Additionally, upgrade Tandoor Recipes to version 2.6.4 or later where this vulnerability is fixed.