Attack Chain

1. An attacker gains legitimate access to a Tandoor Recipes instance.
2. A victim creates a RecipeBook and shares it with the attacker.
3. The attacker identifies the API endpoint for RecipeBook modification (e.g., /api/recipebooks/{id}).
4. The attacker crafts a malicious HTTP PUT request to modify the RecipeBook, bypassing intended permission checks.
5. The attacker sends the crafted PUT request to the Tandoor Recipes server, including data to overwrite existing recipe information.
6. Alternatively, the attacker crafts a malicious HTTP DELETE request to delete the RecipeBook, also bypassing permission checks.
7. The server processes the unauthorized PUT or DELETE request due to the flawed CustomIsShared permission class.
8. The RecipeBook is either modified with the attacker's data or completely deleted, leading to data loss or corruption for the victim.

Impact

Successful exploitation of CVE-2026-35488 allows any user with shared access to a RecipeBook to completely overwrite or delete it. This leads to a complete loss of recipe data for the owner and any other shared users. Given the nature of Tandoor Recipes, the impact is primarily data loss and corruption of personal data; however, in scenarios where Tandoor Recipes is used in a collaborative or professional environment (e.g., a restaurant managing recipes), the impact could extend to operational disruption. While the exact number of vulnerable installations is unknown, the wide adoption of Tandoor Recipes suggests a potentially large user base at risk prior to upgrading to version 2.6.4.

Recommendation

• Upgrade Tandoor Recipes to version 2.6.4 or later to remediate CVE-2026-35488.
• Deploy the Sigma rule "Detect Tandoor RecipeBook Unauthorized Modification" to identify potential exploitation attempts targeting the RecipeBook API endpoint.
• Monitor web server logs for PUT/PATCH/DELETE requests to RecipeBook API endpoints originating from users with only shared access, as indicated by anomalous HTTP request patterns related to RecipeBook IDs.