SQL Exposure Vulnerability in Tandoor Recipes by Tandoor
CVE-2026-33153

7.7HIGH

Key Information:

Vendor

Tandoorrecipes

Status
Recipes
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33153?

The Tandoor Recipes application contains a vulnerability in the Recipe API endpoint that inadvertently exposes a ?debug=true parameter. This parameter reveals complete raw SQL queries, including sensitive information such as table names and access control logic. Notably, this vulnerability allows any authenticated user to access this data, regardless of permissions. As a result, a low-privilege attacker could exploit this flaw to map the database schema and potentially reverse-engineer the authorization model, leading to severe security risks. The issue has been addressed in version 2.6.0.

Affected Version(s)

recipes < 2.6.0

References

https://github.com/TandoorRecipes/recipes/security/adviso...
x_refsource_CONFIRM
https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.