CVE-2026-101033

MediumCVSS 4.3

Published: 27/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 27/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.

Risk Assessment

Risk of privacy breach between households, potentially leading to disclosure of sensitive financial information.

Recommendation

Update KitchenOwl to a version newer than 0.7.10 that includes the fix for verifying category ownership.

Other vulnerabilities in KitchenOwl

CVE-2026-111899Medium
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS