Tombursch CVEs and Security Vulnerabilities

CVE-2026-111899

KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tombursch

Products

Kitchenowl

CVE-2026-101033

KitchenOwl through 0.7.10 IDOR via unchecked category ID

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.