CVE-2026-33152 Tandoor Recipes 身份验证绕过漏洞，已修复

Tandoor Recipes中的CVE-2026-33152漏洞影响2.6.0之前的版本。该应用程序使用Django REST Framework配置BasicAuthentication作为默认身份验证后端之一。虽然AllAuth对HTML登录端点(/accounts/login/)实现了速率限制，但此机制不适用于API端点。攻击者可以通过使用Basic身份验证标头（Authorization: Basic <base64编码的用户名：密码>）向任何API端点发送经过身份验证的请求来利用此漏洞。这可能导致对敏感数据的未经授权的访问、食谱修改、购物清单操作，甚至代表其他用户执行操作，具体取决于分配给API端点的权限。

Organizations and individuals using Tandoor Recipes for recipe management and meal planning are at risk, particularly those relying on the application's API for integration with other services. Shared hosting environments where multiple users share the same server instance are also at increased risk, as a compromise of one user's account could potentially lead to access to other users' data.

• python / server:

# Check for Tandoor Recipes version
python -c "import tandoor_recipes; print(tandoor_recipes.__version__)"

• generic web:

# Check for API endpoints accepting Basic Authentication
curl -u 'user:password' https://<target>/api/recipes

• generic web:

# Check access logs for repeated failed authentication attempts
grep "401 Unauthorized" /var/log/apache2/access.log

1. 2026-03-26Disclosure

   disclosure

1. 已保留2026-03-17
2. 发布日期2026-03-26
3. EPSS 更新日期2026-04-03

推荐的解决方案是将Tandoor Recipes更新到2.6.0或更高版本。此版本通过默认禁用BasicAuthentication来修复漏洞。作为额外的措施，即使您已更新到2.6.0版本，也应在Django REST Framework配置中明确禁用BasicAuthentication。此外，审查并加强对API端点的访问控制，以确保只有授权用户才能访问它们。实施双因素身份验证（2FA）可以提供额外的安全层。