CVE-2026-33153highCWE-89

CVE-2026-33153: high-severity vulnerability in TandoorRecipes recipes

Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic

Published

Follow this CVE+ Monitor recipes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.5%
In short

Tandoor Recipes has a hidden debug feature that shows complete database queries to any logged-in user, revealing the entire database structure and how access control works. An attacker can use this information to find security weaknesses and bypass protections.

Technical detail

An unauthenticated debug parameter (?debug=true) in the Recipe API endpoint exposes raw SQL queries including schema, table relationships, and access control logic to any authenticated user, regardless of privilege level. This information disclosure occurs even in production (DEBUG=False) and enables schema reconnaissance and authorization bypass attacks.

Summary generated and translated by AI from the official description.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint exposes a hidden `?debug=true` query parameter that returns the complete raw SQL query being executed, including all table names, column names, JOIN relationships, WHERE conditions (revealing access control logic), and multi-tenant space IDs. This parameter works even when Django's `DEBUG=False` (production mode) and is accessible to any authenticated user regardless of their privilege level. This allows a low-privilege attacker to map the entire database schema and reverse-engineer the authorization model. Version 2.6.0 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
TandoorRecipes · recipes
Related CVEs — TandoorRecipes recipes

In the same product, most dangerous first.

CVE-2025-23211CRITICALTandoor Recipes - SSTI - Remote Code ExecutionEPSS 3.7%CVE-2025-23212HIGHTandoor Recipes - Local file disclosure - Users can read the content of any file on the serverEPSS 0.5%CVE-2026-33152CRITICALTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationEPSS 0.5%CVE-2026-25964MEDIUMTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadEPSS 0.5%CVE-2026-33148MEDIUMURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyEPSS 0.5%CVE-2026-35488HIGHTandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) usersEPSS 0.4%