Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33153: Tandoor Recipes reveals database details via debug parameter

CVE-2026-33153 · published 7 months ago

Summary

The Recipe API in Tandoor Recipes versions before 2.6.0 lets any logged‑in user add a hidden "debug=true" flag and see the full SQL commands the system runs, exposing table names, column names and how access is controlled. This information lets a low‑privilege user map the database and understand security rules. Upgrade to version 2.6.0 or later to stop the debug output.

What to do

Update tandoor recipes to version 2.6.0 or later.

Affected software

Vendor	Product	Affected versions
tandoor	recipes	< 2.6.0 `cpe:2.3:a:tandoor:recipes::::::::`

Original advisory text

Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint exposes a hidden `?debug=true` query parameter that returns the complete raw SQL query being executed, including all table names, column names, JOIN relationships, WHERE conditions (revealing access control logic), and multi-tenant space IDs. This parameter works even when Django's `DEBUG=False` (production mode) and is accessible to any authenticated user regardless of their privilege level. This allows a low-privilege attacker to map the entire database schema and reverse-engineer the authorization model. Version 2.6.0 patches the issue.

References

https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 URL
https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f83r-v3h5-pch... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33153... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33153 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published26 Mar 2026

Updated4 Nov 2026

First seen26 Mar 2026

Sources

CVE-2026-33153 · NVD

CVE-2026-33153 · OSV

GHSA-f83r-v3h5-pchf · GHSA

Track software like this

Free during beta