TandoorRecipes recipes up to 2.5.3 Host request.build_absolute_uri http headers for scripting syntax

Summaryinfo

A vulnerability marked as problematic has been reported in TandoorRecipes recipes up to 2.5.3. This affects the function request.build_absolute_uri of the component Host Handler. The manipulation leads to improper neutralization of http headers for scripting syntax. This vulnerability is referenced as CVE-2026-33149. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in TandoorRecipes recipes up to 2.5.3. It has been rated as problematic. This issue affects the function request.build_absolute_uri of the component Host Handler. The manipulation with an unknown input leads to a improper neutralization of http headers for scripting syntax vulnerability. Using CWE to declare the problem leads to CWE-644. The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.build_absolute_uri() to generate absolute URLs in multiple contexts, including invite link emails, API pagination, and OpenAPI schema generation. An attacker who can send requests to the application with a crafted Host header can manipulate all server-generated absolute URLs. The most critical impact is invite link poisoning: when an admin creates an invite and the application sends the invite email, the link points to the attacker's server instead of the real application. When the victim clicks the link, the invite token is sent to the attacker, who can then use it at the real application. As of time of publication, it is unknown if a patched version is available.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-33149 since 03/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• TandoorRecipes

Name

• recipes

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3

Website

• Product: https://github.com/TandoorRecipes/recipes/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion