Tandoor Recipes versions before 2.6.4 have an authorization bypass vulnerability (CWE-639) in the POST /api/food/{id}/shopping/ endpoint. This endpoint reads 'amount' and 'unit' directly from request data without validation and passes them to ShoppingListEntry.objects.create(), unlike other endpoints that use a serializer to validate and sanitize inputs. This leads to two issues: unhandled exceptions when 'amount' is non-numeric, causing HTTP 500 errors, and the ability to associate a unit ID from a different tenant space, leaking foreign-key references across tenant boundaries. The vulnerability is addressed in version 2.6.4.

An attacker can cause denial of service via unhandled exceptions (HTTP 500) by submitting invalid 'amount' values. More critically, they can bypass tenant boundaries by associating shopping list entries with unit IDs from other spaces, potentially leaking data across tenants. The CVSS score of 7.3 reflects high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Upgrade Tandoor Recipes to version 2.6.4 or later, where this vulnerability is fixed. The vendor has addressed the issue by adding proper validation and sanitization of input fields in the affected endpoint. No other mitigations are indicated or necessary once the update is applied.