CVE-2026-33153 Information disclosure in recipes

High 7.7 Published 26 Mar 2026 Updated 26 Mar 2026

An unauthenticated debug parameter in Tandoor Recipes leaks raw SQL queries, exposing database schema and access control logic to any authenticated user.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33153?

CVE-2026-33153 is a high-severity vulnerability in TandoorRecipes recipes, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint exposes a hidden `?debug=true` query parameter that returns the complete raw SQL query being executed, including all table names, column names, JOIN relationships, WHERE conditions (revealing access control logic), and multi-tenant space IDs. This parameter works even when Django's `DEBUG=False` (production mode) and is accessible to any authenticated user regardless of their privilege level. This allows a low-privilege attacker to map the entire database schema and reverse-engineer the authorization model. Version 2.6.0 patches the issue.

Weakness: CWE-89

Which versions are affected by CVE-2026-33153?

It affects 1 product.

Products include Tandoor Recipes.

How do I fix CVE-2026-33153?

No fix has been published for CVE-2026-33153 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-33153 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33153 exists.

Sources

Also known as GHSA-f83r-v3h5-pchf.