CVE-2026-33149 is a high-severity vulnerability (CVSS 8.1) affecting Tandoor Recipes versions up to 2.5.3, stemming from the application's default configuration allowing unvalidated HTTP Host headers. This flaw enables an attacker to manipulate server-generated absolute URLs, most critically leading to invite link poisoning where invite tokens can be captured. The attack vector is network-based with low complexity, but requires high privileges (admin creating an invite) and user interaction. Currently, there is no evidence of active exploitation, nor are public exploit codes available in common databases. Community discussion regarding this vulnerability remains minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.5.3CPE matchmatch criteria | cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.