Attack Chain

1. The attacker identifies a Tandoor Recipes instance running a version prior to 2.6.0.
2. The attacker discovers valid usernames through OSINT techniques or by leveraging other vulnerabilities (not described in source).
3. The attacker crafts HTTP requests with Authorization: Basic headers targeting an API endpoint that accepts authenticated requests.
4. The attacker sends multiple requests with different password guesses using a scripting language like Python and the requests library.
5. The Tandoor Recipes server authenticates the request if the credentials match a valid user.
6. If successful, the attacker gains access to the targeted user's account.
7. The attacker accesses, modifies, or exfiltrates recipes, meal plans, shopping lists, and potentially other user data.
8. The attacker pivots to other user accounts if sufficient privileges exist, further expanding their access and potential damage.

Impact

Successful exploitation of CVE-2026-33152 allows attackers to compromise user accounts on vulnerable Tandoor Recipes instances. This can lead to unauthorized access to sensitive user data, including personal recipes, meal plans, and shopping lists. Depending on the application's deployment and user permissions, attackers may also be able to modify data, add malicious content, or pivot to other systems. The lack of rate limiting makes password guessing attacks highly effective, increasing the risk of widespread account compromise.

Recommendation

• Upgrade Tandoor Recipes instances to version 2.6.0 or later to patch CVE-2026-33152.
• Implement rate limiting on API endpoints that accept BasicAuthentication, independent of AllAuth's HTML login rate limiting.
• Deploy the Sigma rule Detect Tandoor Recipes Basic Authentication Brute Force to identify potential password guessing attempts against Tandoor Recipes instances in your environment.
• Monitor web server logs for excessive Authorization: Basic header usage targeting Tandoor Recipes API endpoints.