Filtered by vendor Tombursch Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-111899 1 Tombursch 1 Kitchenowl 2026-10-20 4.3 Medium
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.
CVE-2026-101033 1 Tombursch 1 Kitchenowl 2026-09-30 4.3 Medium
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.