CVE-2026-35045-PoC

CVE-2026-35045 — Broken Object-Level Authorization in Tandoor Recipes Summary The PUT /api/recipe/batchupdate/ endpoint in Tandoor Recipes v2.6.1 allows any authenticated user within a Space to modify any recipe in that Space — including private recipes owned by other users. This completely...