KitchenOwl Household Isolation Bypass via Category ID Exposure

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in KitchenOwl through version 0.7.10. Authenticated attackers can exploit unchecked category IDs in expense and item operations to access data from other households. By enumerating sequential category IDs, attackers can read sensitive information like category names, budgets, and colors belonging to different households, breaking the app's isolation model.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your KitchenOwl instance allows unauthorized access to category IDs from other households. Use API requests to test sequential category IDs and verify if non-household data is exposed. Example: Send authenticated requests to /api/categories/{id} with IDs outside your household and check responses for sensitive data like names, budgets, or colors.

Useful 0 Not Useful 0

Impact Analysis

If you use KitchenOwl, an attacker with access to your account could view financial or household details from other users on the same server. This includes category names that may reveal budgeting habits, colors that could indicate household preferences, and budgets that might expose financial information. The impact depends on the sensitivity of the exposed data in other households.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or financial data across households, violating data isolation principles required by GDPR and HIPAA. Exposure of household budgets or category names may constitute a breach of confidentiality, potentially resulting in regulatory penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade KitchenOwl to a version that includes the fix for CVE-2026-101033. If upgrading is not possible, apply the patch manually by ensuring category IDs are validated against household ownership in addItem, updateItem, addExpense, and updateExpense functions. Restrict API access to trusted users and monitor logs for unauthorized category access attempts.

Useful 0 Not Useful 0