Recipes CVE-2026-33149

Tandoor Recipes versions up to 2.5.3 with default ALLOWED_HOSTS = '*' configuration. Requires high-privilege authenticated user to generate invite links. Victim must click attacker-crafted link in invite email to be redirected to attacker-controlled domain.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N indicates a network-exploitable vulnerability with low attack complexity but requiring high privileges (administrator) and user interaction, with changed scope and high confidentiality and integrity impact. The PR:H and UI:R requirements significantly constrain exploitation: an attacker must first compromise an administrator account or convince a legitimate admin to trigger invite creation, then the victim must click the poisoned link. The changed scope (S:C) reflects that the attack chain crosses trust boundaries from the application to email recipients. No EPSS score, KEV status, or POC availability data were provided in the intelligence sources. Real-world risk is moderate rather than critical: while the CVSS base score of 8.1 is high, practical exploitation requires social engineering of administrators and relies on victims clicking malicious links. Organizations with strict email security controls, security awareness training, and restricted admin account usage face lower practical risk. The attack is not automatable and requires specific triggering conditions, making mass exploitation unlikely. Priority should be elevated for internet-facing instances with multiple administrators and frequent invite generation workflows.

An attacker identifies a Tandoor Recipes instance accessible over the network and sends HTTP requests with a crafted Host header pointing to their controlled domain (e.g., Host: attacker.example.com). When a legitimate administrator creates a new user invite through the application interface, the system generates an invite email containing a link built using request.build_absolute_uri(), which incorporates the attacker's malicious Host header value. The victim receives an email appearing to originate from the legitimate application but containing a link to https://attacker.example.com/invite?token=SECRET_INVITE_TOKEN. Upon clicking the link, the victim's browser sends the invite token to the attacker's server, where it is captured in access logs. The attacker then uses the stolen token at the legitimate application URL to gain unauthorized access with the privileges intended for the invited user.