CVE-2026-33149

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.build_absolute_uri() to generate absolute URLs in multiple contexts, including invite link emails, API pagination, and OpenAPI schema generation. An attacker who can send requests to the application with a crafted Host header can manipulate all server-generated absolute URLs. The most critical impact is invite link poisoning: when an admin creates an invite and the application sends the invite email, the link points to the attacker's server instead of the real application. When the victim clicks the link, the invite token is sent to the attacker, who can then use it at the real application. As of time of publication, it is unknown if a patched version is available.

• CWE-644

• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-x636-4jx6-xc4wExploit, Vendor Advisory
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-x636-4jx6-xc4wExploit, Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33143OneUptime is a solution for monitoring and managing online s…7.5
• CVE-2026-33144GPAC is an open-source multimedia framework. Prior to commit…7.8
• CVE-2026-33145xrdp is an open source RDP server. Versions through 0.10.5 a…6.3
• CVE-2026-33146Docmost is open-source collaborative wiki and documentation …4.3
• CVE-2026-33147GMT is an open source collection of command-line tools for m…7.8
• CVE-2026-33148Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-3315Incorrect Default Permissions, : Execution with Unnecessary …7.8
• CVE-2026-33150libfuse is the reference implementation of the Linux FUSE. F…7.8
• CVE-2026-33151Socket.IO is an open source, real-time, bidirectional, event…7.5
• CVE-2026-33152Tandoor Recipes is an application for managing recipes, plan…7.5
• CVE-2026-33153Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-33154dynaconf is a configuration management tool for Python. Prio…8.1