CVE-2026-101033
KitchenOwl through 0.7.10 IDOR via unchecked category ID
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 27, 2026
- Updated
- Sep 30, 2026
- Reserved
- Sep 27, 2026
Description
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
kitchenowlTomBursch |
|
References
- GitHub Issue #1154issue-tracking
- https://github.com/TomBursch/kitchenowl/pull/1155patchissue-tracking
- https://github.com/TomBursch/kitchenowl/commit/c15f6cb21a98d5eb70746bee6b63773a6d6a6251patch
- https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/expense/expense_controller.py#L115-L118technical-description
- https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/item/item_controller.py#L86-L88technical-description
- https://github.com/TomBursch/kitchenowlproduct
- VulnCheck Advisory: KitchenOwl through 0.7.10 IDOR via unchecked category IDthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.