CVE-2026-35045

CVE-2026-35045 is an authorization bypass vulnerability affecting Tandoor Recipes prior to version 2.6.4. The flaw exists in the PUT /api/recipe/batch_update/ endpoint, which fails to enforce object-level authorization checks, allowing any authenticated user within a Space to modify recipes belonging to other users, including those marked as private. This vulnerability enables forced exposure of private recipes, unauthorized access modifications, and metadata tampering. The vulnerability carries a CVSS 3.1 score of 8.1 (HIGH) with a network-based attack vector requiring only low complexity and valid user credentials. The attack requires no user interaction and impacts confidentiality and integrity without affecting availability. The FAUCET Risk Score of 50.0 and EPSS score of 0.00033 indicate a moderate exploitation likelihood relative to other CVEs. Currently, there is no evidence of active exploitation or public exploit code availability, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no activity on community hot lists. Organizations using Tandoor Recipes should prioritize upgrading to version 2.6.4 or later to remediate this authorization bypass before exploitation becomes widespread.