Which versions of Python are affected by CVE-2026-33153?

Tandoor Recipes versions before 2.6.0 contain an authentication bypass in the Recipe API that exposes the complete database schema and access control logic to any authenticated user, enabling…. A patch is available.

How to fix or mitigate CVE-2026-33153?

Within 24 hours: Inventory all Tandoor Recipes deployments and confirm current versions; restrict API access via network controls if upgrade is not immediately feasible. Within 7 days: Upgrade all instances to version 2.6.0 or later per vendor advisory. Within 30 days: Audit access logs for suspicious Recipe API queries using the debug parameter; review user access privileges and revoke unnecessary authenticated accounts; conduct a multi-tenant data exposure assessment to identify any extracted schema or tenant identifiers.

Python CVE-2026-33153

Q: What is the CVSS score of CVE-2026-33153?

CVE-2026-33153 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16317 HIGH

SQL Injection (CWE-89)

2026-03-26 GitHub_M

SQLi Python

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:13 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.6.0

EUVD ID Assigned

Mar 26, 2026 - 19:16 euvd

EUVD-2026-16317

Analysis Generated

Mar 26, 2026 - 19:16 vuln.today

CVE Published

Mar 26, 2026 - 19:06 nvd

HIGH 7.7

DescriptionGitHub Advisory

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint exposes a hidden ?debug=true query parameter that returns the complete raw SQL query being executed, including all table names, column names, JOIN relationships, WHERE conditions (revealing access control logic), and multi-tenant space IDs. This parameter works even when Django's DEBUG=False (production mode) and is accessible to any authenticated user regardless of their privilege level. This allows a low-privilege attacker to map the entire database schema and reverse-engineer the authorization model. Version 2.6.0 patches the issue.

AnalysisAI

Tandoor Recipes application versions prior to 2.6.0 expose complete database schema and access control logic through an undocumented debug parameter in the Recipe API endpoint, allowing any authenticated user to extract raw SQL queries including table structures, JOIN relationships, WHERE conditions, and multi-tenant space identifiers even in production environments with DEBUG=False. A proof-of-concept exploit is available (SSVC exploitation status: poc). The CVSS 4.0 score of 7.7 reflects network-based exploitation with no attack complexity, and SSVC indicates the vulnerability is automatable with partial technical impact.

Technical ContextAI

The vulnerability affects Tandoor Recipes (CPE: cpe:2.3:a:tandoorrecipes:recipes:*:*:*:*:*:*:*:*), a Python-based Django application for recipe and meal management. The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The Recipe API endpoint implements a hidden query parameter '?debug=true' that bypasses Django's production safety controls (DEBUG=False setting) and returns complete SQL query strings to the caller. This exposes internal database implementation details including schema design, access control predicates, and tenant isolation mechanisms that should never be visible to application users. The implementation fails to restrict debug functionality to development environments or privileged administrators, treating it as a production feature accessible to any authenticated session.

RemediationAI

Upgrade Tandoor Recipes to version 2.6.0 or later, which removes the vulnerable debug parameter from the Recipe API endpoint (vendor-released patch: version 2.6.0). The fix is available through the official release at https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 and documented in the GitHub security advisory at https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f83r-v3h5-pchf. Until patching is feasible, implement Web Application Firewall (WAF) rules or reverse proxy filtering to block HTTP requests containing the 'debug=true' query parameter on Recipe API endpoints. For multi-tenant deployments, audit logs for requests containing the debug parameter to identify potential reconnaissance activity, and review application user privilege assignments to limit blast radius of information disclosure.