🚨 CVE-2026-101033
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.
🎖@cveNotify
GitHub
GitHub - TomBursch/kitchenowl: KitchenOwl is a self-hosted grocery list and recipe manager. The backend is made with Flask and…
KitchenOwl is a self-hosted grocery list and recipe manager. The backend is made with Flask and the frontend with Flutter. Easily add items to your shopping list before you go shopping. You can als...
September 27, 2026 99
