Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-101033KitchenOwl through 0.7.10 IDOR via unchecked category ID
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in kitchenowl from TomBursch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 87.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TomBursch | kitchenowl | 0 – through 0.7.10 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Issue #1154 issue-tracking
- https://github.com/TomBursch/kitchenowl/pull/1155 patch, issue-tracking
- https://github.com/TomBursch/kitchenowl/commit/c15f6cb21a98d5eb70746bee6b63773a6d6a6251 patch
- https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/expense/expense_controller.py#L115-L118 technical-description
- https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/item/item_controller.py#L86-L88 technical-description
- https://github.com/TomBursch/kitchenowl product
- VulnCheck Advisory: KitchenOwl through 0.7.10 IDOR via unchecked category ID third-party-advisory