IDOR Vulnerability in KitchenOwl Product by TomBursch
CVE-2026-101033

5.3MEDIUM

Key Information:

Vendor

Tombursch

Status
Kitchenowl
Vendor
CVE Published:
27 September 2026

What is CVE-2026-101033?

The KitchenOwl application, up to version 0.7.10, exhibits an Insecure Direct Object Reference (IDOR) vulnerability. This issue arises from insufficient validation of category IDs, allowing authenticated attackers to access information such as category names, budgets, and colors associated with other users' households. This breach compromises the intended isolation between household data, enabling potential enumeration of sensitive financial information across different accounts.

Affected Version(s)

kitchenowl 0 <= 0.7.10

References

https://github.com/TomBursch/kitchenowl/issues/1154
issue-tracking
https://github.com/TomBursch/kitchenowl/pull/1155
patchissue-tracking
https://github.com/TomBursch/kitchenowl/commit/c15f6cb21a...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.