---
id: CVE-2026-101033
title: >-
  KitchenOwl through 0.7.10 fails to verify that category IDs belong to the
  caller's household in expense and item operations
summary: >-
  KitchenOwl through 0.7.10 fails to verify that category IDs belong to the
  caller's household in expense and item operations. Authenticated attackers can
  enumerate category IDs from other households to read their category names,
  budgets, …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: TomBursch
product: kitchenowl
affected:
  - kitchenowl <= 0.7.10
published: '2026-09-27'
updated: '2026-09-27'
sourceUpdated: '2026-09-27T14:16:29.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101033'
references:
  - url: 'https://github.com/TomBursch/kitchenowl'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/expense/expense_controller.py#L115-L118
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/item/item_controller.py#L86-L88
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TomBursch/kitchenowl/commit/c15f6cb21a98d5eb70746bee6b63773a6d6a6251
    label: disclosure@vulncheck.com
  - url: 'https://github.com/TomBursch/kitchenowl/issues/1154'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/TomBursch/kitchenowl/pull/1155'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/kitchenowl-through-0.7.10-idor-via-unchecked-category-id
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-27T13:53:26.576Z'
---

## Overview

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.