Description
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TomBursch | kitchenowl | ≤ 0.7.10 | — |
References
- GitHub Issue #1154 issue-tracking
- https://github.com/TomBursch/kitchenowl/pull/1155 patch issue-tracking
- https://github.com/TomBursch/kitchenowl/commit/c15f6cb21a98d5eb70746bee6b63773a6d6a6251 patch
- https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/expense/expense_controller.py#L115-L118 technical-description
- https://github.com/TomBursch/kitchenowl/blob/09aaf5fbd2343fcc10b12e906c63c3764dd38919/backend/app/controller/item/item_controller.py#L86-L88 technical-description
- https://github.com/TomBursch/kitchenowl product
- VulnCheck Advisory: KitchenOwl through 0.7.10 IDOR via unchecked category ID third-party-advisory