KitchenOwl EUVD-2026-87946

Requires a valid authenticated account (PR:L) on a KitchenOwl instance that hosts multiple households, since the attack reads categories belonging to households other than the caller's. Exploitation targets the expense and item create/update API operations (addExpense/updateExpense, addItem/updateItem) where a caller-supplied category ID is used without verifying category.household_id matches the caller's household. No user interaction is needed. Impact is limited to reading category metadata (names, budgets, colors); it does not permit modification or cross-household writes, and single-household/single-tenant deployments have little to disclose. Affected versions are KitchenOwl through 0.7.10; upgrading past the PR #1155 fix eliminates the flaw.

This is a genuine but low-severity broken-object-level-authorization (IDOR) flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires an authenticated account (PR:L), and impact is confined to confidentiality (VC:L only; VI:N/VA:N) - an attacker can read other households' category names, budgets, and colors but cannot modify or destroy data. No EPSS score, no CISA KEV listing, and no standalone public exploit are provided; per the precision rules this is 'no public exploit identified at time of analysis.' The vendor has shipped a patch (PR #1155 / commit c15f6cb2), and the fix diff confirms the root cause precisely (missing category.household_id == household_id checks in expense and item controllers), so the technical claim is well-substantiated. Net: this is a real data-isolation bug worth patching in multi-tenant deployments, but it is a low-priority issue rather than a high-urgency one - limited disclosure impact, requires authentication, and no evidence of exploitation. The 5.3 score is consistent with a low-confidentiality-only leak.

An authenticated KitchenOwl user on a shared/multi-household instance submits expense or item create/update requests while substituting category IDs they do not own, iterating through numeric IDs to enumerate categories belonging to other households. The server returns the foreign category's name, budget, and color, breaking household isolation. No public exploit code is referenced, though the mechanics are trivial to reproduce from the described API behavior and the published fix.