CVE-2026-35489

OVERVIEW: CVE-2026-35489 affects Tandoor Recipes versions prior to 2.6.4, a recipe and meal planning application. The vulnerability exists in the POST /api/food/{id}/shopping/ endpoint, which fails to properly validate user-supplied amount and unit parameters before passing them to the database layer, unlike other endpoints that use proper serialization. SEVERITY: The vulnerability carries a CVSS 3.1 score of 7.3 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The flaw has low attack complexity and impacts confidentiality, integrity, and availability. It can be exploited by unauthenticated remote attackers to trigger application crashes via invalid input and to access or manipulate unit references across tenant boundaries, potentially leaking cross-space foreign-key information. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild. The vulnerability is not tracked in the National Vulnerability Database's Known Exploited Vulnerabilities catalog and carries a low EPSS score of 0.00135, indicating minimal likelihood of exploitation. No public exploit code has been reported, and community attention remains limited. The issue is fixed in version 2.6.4 and later.