CVE-2026-101033

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101033
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101033.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101033
Published
2026-09-27T13:16:56Z
Modified
2026-09-30T03:31:01Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
KitchenOwl through 0.7.10 IDOR via unchecked category ID
Details

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101033.json"
}
References

Affected packages

Git / github.com/tombursch/kitchenowl

Affected ranges

Type
GIT
Repo
https://github.com/tombursch/kitchenowl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
09aaf5fbd2343fcc10b12e906c63c3764dd38919
Fixed
c15f6cb21a98d5eb70746bee6b63773a6d6a6251
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.7.10"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

beta-v0.*
beta-v0.0.34
beta-v0.0.37
beta-v0.0.38
beta-v0.0.39
beta-v0.0.42
beta-v0.0.43
beta-v0.0.44
beta-v0.0.46
beta-v0.0.47
beta-v0.2.0
beta-v0.2.1
beta-v0.2.2
beta-v0.2.3
beta-v0.2.4
beta-v0.2.6
beta-v0.2.7
beta-v0.3.11
beta-v0.3.3
beta-v0.3.7
beta-v0.3.8
beta-v0.3.9
beta-v0.4.0
beta-v0.4.1
beta-v0.4.22
beta-v0.6.0
v0.*
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.14
v0.0.15
v0.0.16
v0.0.17
v0.0.18
v0.0.19
v0.0.20
v0.0.21
v0.0.22
v0.0.23
v0.0.24
v0.0.25
v0.0.26
v0.0.28
v0.0.29
v0.0.30
v0.0.31
v0.0.32
v0.0.33
v0.0.35
v0.0.40
v0.0.41
v0.0.45
v0.0.9
v0.1.0
v0.2.5
v0.3.0
v0.3.1
v0.3.10
v0.3.12
v0.3.13
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.18
v0.4.19
v0.4.2
v0.4.20
v0.4.21
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.5.2
v0.6.1
v0.6.10
v0.6.11
v0.6.12
v0.6.13
v0.6.14
v0.6.15
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.6.8
v0.6.9
v0.7.0
v0.7.1
v0.7.10
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101033.json"