CVE-2026-101033CWE-639

CVE-2026-101033

Medium · published September 27, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00222 · 12.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-27T18:16Z
References (7)
https://github.com/TomBursch/kitchenowl · [email protected]https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/expense/expense_controller.py#L115-L118 · [email protected]https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/item/item_controller.py#L86-L88 · [email protected]https://github.com/TomBursch/kitchenowl/commit/c15f6cb21a98d5eb70746bee6b63773a6d6a6251 · [email protected]https://github.com/TomBursch/kitchenowl/issues/1154 · [email protected]https://github.com/TomBursch/kitchenowl/pull/1155 · [email protected]https://www.vulncheck.com/advisories/kitchenowl-through-0.7.10-idor-via-unchecked-category-id · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 27 SEP 13:16Z
    KitchenOwl through 0.7.10 IDOR via unchecked category ID
    cvelistv5