A hidden debug query parameter is exposed in Tandoor Recipes versions older than 2.6.0. When an authenticated user appends ?debug=true to the Recipe API endpoint, the application returns the entire raw SQL query it executes, including table and column names, join clauses, where conditions that embed access control logic and multi‑tenant space identifiers. This disclosure allows attackers to recover the database schema, understand the authorization model, map critical data, and consequently suffer high‑level information leakage. No code execution or denial of service is facilitated by this flaw.

The vulnerability affects the Tandoor Recipes application, specifically the recipes module. All releases before version 2.6.0 are susceptible; any instance running those versions, irrespective of deployment environment, is at risk while operating in production mode where Django's DEBUG setting is disabled.

The flaw has a CVSS score of 7.7 indicating high severity. With an EPSS score below 1%, the likelihood of active exploitation is currently low, and it is not listed in the CISA KEV catalog. However, the attack requires only an authenticated session and no special privileges, making exploitation relatively easy. Once leveraged, the attacker can map the entire database structure and infer the application's permission scheme, threatening confidentiality and potentially aiding future attacks.