CVE-2026-101033: KitchenOwl through 0.7.10 IDOR via unchecked category ID
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to KitchenOwl. The issue affects users who can perform expense or item operations and can supply category IDs.
What information could be exposed?
An attacker can enumerate category IDs belonging to other households and read category names, budgets, and colors. The described impact is disclosure of category data across household boundaries; no modification or availability impact is stated.
Are deployments affected by default?
The provided information does not identify any configuration prerequisite or disabled-by-default feature. The vulnerable behavior is tied to expense and item operations that accept category IDs.
How can teams determine whether they are affected?
KitchenOwl versions through 0.7.10 are affected. Affected behavior can be checked by using an authenticated account in one household to submit category IDs from another household in expense or item operations and observing whether category details are returned.
What can be done before updating?
No temporary mitigation is provided in the available data. Limit access to authenticated accounts that can use expense and item operations until the category ownership validation is addressed.