CVE-2026-101033Published
KitchenOwl through 0.7.10 IDOR via unchecked category ID
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-101033 · Microsoft / collected KEV context
cve-program · CVE-2026-101033
- https://github.com/TomBursch/kitchenowl/issues/1154
- https://github.com/TomBursch/kitchenowl/pull/1155
- https://github.com/TomBursch/kitchenowl/commit/c15f6cb21a98d5eb70746bee6b63773a6d6a6251
- https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/expense/expense_controller.py#L115-L118
- https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/item/item_controller.py#L86-L88
- https://github.com/TomBursch/kitchenowl
- https://www.vulncheck.com/advisories/kitchenowl-through-0.7.10-idor-via-unchecked-category-id
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.