CVE-2026-33152 affects Tandoor Recipes versions prior to 2.6.0, allowing unauthenticated attackers to perform unlimited password guessing against user accounts. This high-severity vulnerability (CVSS 7.5) stems from a misconfiguration in Django REST Framework's BasicAuthentication, which bypasses rate limiting on API endpoints. An attacker can leverage this low-complexity network attack to compromise user accounts, leading to high confidentiality impact. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion. Users are advised to upgrade to Tandoor Recipes version 2.6.0 or later to patch this issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.6.0CPE matchmatch criteria | cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.