CVE-2026-33153: Tandoor Recipes Information Disclosure

CVE-2026-33153 Overview

CVE-2026-33153 is a Debug Information Disclosure vulnerability in Tandoor Recipes, an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint exposes a hidden ?debug=true query parameter that returns the complete raw SQL query being executed. This includes all table names, column names, JOIN relationships, WHERE conditions (revealing access control logic), and multi-tenant space IDs.

The vulnerability is particularly dangerous because this debug parameter works even when Django's DEBUG=False (production mode) and is accessible to any authenticated user regardless of their privilege level. This allows a low-privilege attacker to map the entire database schema and reverse-engineer the authorization model, potentially facilitating further attacks such as SQL injection or privilege escalation.

Critical Impact

Any authenticated user can extract complete database schema information including table structures, access control logic, and multi-tenant space identifiers, enabling reconnaissance for more severe attacks.

Affected Products

• Tandoor Recipes versions prior to 2.6.0

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33153 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33153

Vulnerability Analysis

This vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and represents a significant information disclosure issue in the Tandoor Recipes application. The core problem lies in an improperly secured debug functionality that exposes sensitive database internals through the Recipe API endpoint.

When the ?debug=true query parameter is appended to API requests, the application returns raw SQL queries that reveal the complete database schema. This includes table names, column names, JOIN relationships between tables, WHERE clause conditions that expose access control logic, and multi-tenant space identifiers used to segregate user data.

The vulnerability undermines the application's security posture by allowing attackers to understand how authorization is implemented, identify potential injection points, and map data relationships that could be exploited in subsequent attacks.

Root Cause

The root cause of this vulnerability is the inclusion of a debug parameter in production code that bypasses the standard Django DEBUG setting. The Recipe API endpoint contains logic that responds to the ?debug=true query parameter and outputs raw SQL queries regardless of whether the Django application is running in production mode (DEBUG=False). This represents a failure to properly gate debug functionality behind appropriate access controls and environment checks.

Attack Vector

The attack vector for CVE-2026-33153 is network-based and requires only basic authentication. An attacker with any level of authenticated access to the Tandoor Recipes application can exploit this vulnerability by simply appending ?debug=true to Recipe API endpoint requests. The exposed SQL queries provide detailed reconnaissance information that can be used to:

1. Map the complete database schema and table relationships
2. Understand access control implementation and identify bypass opportunities
3. Extract multi-tenant space IDs that could enable cross-tenant data access
4. Identify potential SQL injection points based on query structure
5. Reverse-engineer the authorization model to find privilege escalation paths

No special tools or complex exploitation techniques are required—a standard web browser or HTTP client is sufficient to extract this sensitive information.

Detection Methods for CVE-2026-33153

Indicators of Compromise

• API requests to Recipe endpoints containing the ?debug=true query parameter
• Unusually detailed SQL query information in application logs or responses
• Patterns of authenticated users accessing multiple API endpoints with debug parameters
• Reconnaissance activity preceding SQL injection or privilege escalation attempts

Detection Strategies

• Monitor web application logs for requests containing debug=true query parameter patterns
• Implement Web Application Firewall (WAF) rules to alert on debug parameter usage in API requests
• Configure application-level logging to track when debug output is generated
• Deploy intrusion detection rules to identify attempts to enumerate database schemas

Monitoring Recommendations

• Review access logs regularly for suspicious debug parameter usage across API endpoints
• Set up alerts for any authenticated user making requests with debug parameters to multiple endpoints
• Monitor for follow-up attacks that may leverage extracted schema information, such as SQL injection attempts
• Track API access patterns for users who have triggered debug functionality

How to Mitigate CVE-2026-33153

Immediate Actions Required

• Upgrade Tandoor Recipes to version 2.6.0 or later immediately
• Review application logs for any prior exploitation attempts using the debug=true parameter
• Audit user accounts for suspicious activity that may indicate reconnaissance
• Consider rotating database credentials if schema exposure is confirmed

Patch Information

The vulnerability has been patched in Tandoor Recipes version 2.6.0. Users should upgrade to this version or later to remediate the vulnerability. The patch removes the exposed debug functionality from production API endpoints.

For detailed information about the fix, see the GitHub Release Version 2.6.0 and the GitHub Security Advisory GHSA-f83r-v3h5-pchf.

Workarounds

• Deploy a Web Application Firewall (WAF) rule to block requests containing debug=true query parameter
• Implement network-level access controls to restrict API access to trusted users only
• Configure reverse proxy rules to strip or reject requests with debug parameters
• Consider temporarily disabling external access to the Recipe API until the patch can be applied

# Example nginx configuration to block debug parameter
location /api/recipe {
    if ($args ~* "debug=true") {
        return 403;
    }
    proxy_pass http://tandoor_backend;
}