PT-2026-99544 · Unknown · Kitchenowl
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
KitchenOwl versions prior to 0.7.11
Description
Authenticated users can bypass household isolation during expense and item operations because the system fails to verify if category IDs belong to the caller's household. This allows attackers to enumerate category IDs from other households to access sensitive information, including category names, budgets, and colors.
Recommendations
Update KitchenOwl to version 0.7.11 or later.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kitchenowl